Install

One command.

Linux and macOS (x86_64 and arm64). It picks the right archive for the machine, verifies the signed manifest and the archive before it installs anything, and needs no sudo. Add -s -- --dry-run after sh to see what it would choose without changing anything.

curl -fsSL https://downloads.tenzro.com/install.sh | sh

Windows (PowerShell):

irm https://downloads.tenzro.com/install.ps1 | iex

Then run tenzro; the first run takes you through setup. Run the installer again to update. The scripts are covered by TLS only; their hashes are in install.sh.sha256 and install.ps1.sha256, and the manual, verify-it-yourself steps are below and at Verify your download.

Node

Run any role on the network.

Each archive holds tenzro-node, the tenzro CLI and, on Linux, the installer tenzro-node-install. The Windows build needs the NVIDIA driver and the CUDA 13 runtime; cuDNN 9 as well for ONNX models on the GPU.

Linux x86_64

tenzro-node-linux-x86_64-cpu.tar.gz

CPU build · glibc 2.39 or newer

98 MB

Linux aarch64

tenzro-node-linux-aarch64-cpu.tar.gz

CPU build · glibc 2.39 or newer

93 MB

Linux aarch64

tenzro-node-linux-aarch64-cuda.tar.gz

NVIDIA CUDA build · glibc 2.39 or newer

803 MB

Windows x86_64

tenzro-node-windows-x86_64-cuda.zip

NVIDIA CUDA build · NVIDIA driver and CUDA 13 runtime

467 MB

macOS Apple silicon

tenzro-node-macos-aarch64-metal.tar.gz

Metal build

87 MB

macOS Intel

tenzro-node-macos-x86_64-cpu.tar.gz

CPU build

78 MB

Run

tar -xzf tenzro-node-linux-x86_64-cpu.tar.gz
cd tenzro-node-linux-x86_64-cpu
./bin/tenzro-node hardware
./bin/tenzro setup

Verify

curl -O https://downloads.tenzro.com/SHA256SUMS
curl -O https://downloads.tenzro.com/SHA256SUMS.sig
curl -O https://downloads.tenzro.com/tenzro-release.pub
cosign verify-blob --key tenzro-release.pub --insecure-ignore-tlog=true \
  --signature SHA256SUMS.sig SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

SHA256SUMS lists every archive and is signed with the Tenzro release key (SHA256SUMS.sig, public key tenzro-release.pub). The key is held in a TPM; its fingerprint is in RELEASE-KEY.txt. The signature is not uploaded to a transparency log, so cosign 3 needs --insecure-ignore-tlog=true. MANIFEST.txt and matrix.json record how each archive was built; the software bill of materials and the build provenance (an unsigned in-toto statement; the signed object is SHA256SUMS) are in the same folder. Built from commit 3870736ac9e05276ee286100ac0bcfa456b3f7c0. The signature is a classical ECDSA P-256 signature from a hardware-held key; a post-quantum signature is planned as a follow-up. Steps for Linux, macOS and Windows: Verify your download. Source is Apache-2.0 licensed.

Join

Replay from genesis.

On this release a new node joins by block replay from genesis: start it with the network's genesis file and it replays the chain from block 0, then follows the network. Joining from a snapshot arrives in an update.

tenzro-node --genesis genesis.toml

Running a node needs a TPM 2.0, or a Mac with a Secure Enclave, for its keys. A genesis validator needs its own TPM 2.0 or Secure Enclave; a machine whose keys are in another machine's TPM joins after genesis with tenzro validator register --tpm-key-holder. Steps: Getting started.