Installing BitExact#

BitExact is licensed software, delivered to you privately: through read access to its container registry, or as a release bundle you can install with no network at all. You need the license file you were issued. To get access, start a pilot: https://bitexact.ai/business#pilot or sales@bitexact.ai.

1. Check the bundle#

Every release carries SHA256SUMS and its signature, SHA256SUMS.sigstore.json, made with the BitExact release key. Its public half, cosign.pub, comes with your license, never in the bundle it checks. First check that the sums are ours, then check the files you received against them, before installing anything:

cosign verify-blob --key cosign.pub --bundle SHA256SUMS.sigstore.json SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

The signature is also recorded in Sigstore's public transparency log, and cosign checks that entry too. On a host with no route to it, add --insecure-ignore-tlog=true: the key signature is still checked, and any connected machine can check the log entry for the same file.

The last line of SHA256SUMS is the image digest. The image is signed with the same key and carries its SBOM as an attestation; check it with cosign verify --key cosign.pub <registry>/bitexact@sha256:<digest>, and pin that key in your admission policy (Hardening).

2. The image#

With registry access. Your GitHub account or team has been granted read access to the package. Log in with a personal access token that has the read:packages scope, and pull by version:

echo "$TOKEN" | docker login ghcr.io -u <github-user> --password-stdin
docker pull ghcr.io/bitexact/bitexact:v0.0.1-alpha

From the bundle, on a host with no route to any registry:

IMAGE=$(docker load -q -i bitexact-0.0.1-alpha-amd64.tar | sed -n 's/^Loaded image: //p')   # or -arm64
IMAGE=$(docker image inspect --format '{{.Id}}' "$IMAGE")   # the digest of what you loaded; deploy by it

Either way you may push it into your own registry and deploy from there.

3. The Python package#

Release builds exist for Linux x86_64 and ARM64 (glibc, and musl for Alpine), Windows x86_64, and x86_64 and ARM64 server images (scripts/targets.py). There is no build for macOS, Windows on ARM, s390x, ppc64le, FreeBSD, AIX or Solaris.

For agents that use the Python SDK, take the bundle for your platform - manylinux-x86_64, manylinux-aarch64, musllinux-x86_64 (Alpine), musllinux-aarch64 or win-amd64 - and install from it alone, every file checked against its hash. It holds the compiled product wheel, the open verifier wheel and every dependency wheel, so no index is needed. For the PostgreSQL store, an HSM or AWS KMS, install requirements-postgres.lock, requirements-hsm.lock or requirements-aws.lock in place of requirements.lock; each is complete on its own:

tar -xzf bitexact-bundle-0.0.1-alpha-<platform>.tar.gz && cd <platform>
pip install --no-index --find-links wheels --require-hashes -r requirements.lock
pip install --no-index --no-deps bitexact_sdk-0.0.1a0-*.whl
pip check

4. The TypeScript, Go and Java SDKs#

npm install ./bitexact-sdk-0.0.1-alpha.tgz               # Node 26 or later

For Java 27 or later, install the jar into your local repository (or your organization's private Maven repository) and depend on dev.bitexact:bitexact-sdk:0.0.1-alpha:

mvn install:install-file -Dfile=bitexact-sdk-0.0.1-alpha.jar \
  -DgroupId=dev.bitexact -DartifactId=bitexact-sdk -Dversion=0.0.1-alpha -Dpackaging=jar

Every SDK carries the release's version, so a private npm or Maven mirror sees a new version with each release rather than the same one changed.

For Go, either fetch the module from the licensee repository with GOPRIVATE=github.com/bitexact/* set, or vendor it from bitexact-sdk-go-0.0.1-alpha.tar.gz; sdk-go/README.md in that archive shows both.

5. License and deployment#

Point BITEXACT_LICENSE at your license file wherever BitExact records. bitexact-deploy-0.0.1-alpha.tar.gz holds the compose file, systemd units and Kubernetes manifests, with the guides for distributed recording (docs/distributed.md) and model providers (docs/providers.md).