Core-Geth downloads
Get the Core-Geth client.
Download a release for Linux, macOS or Windows, run it as a container, or build it from source. Every archive and image is published with a checksum and a build attestation, so you can confirm what you downloaded before you run it.
Install Core-Geth
How to download, install, and run the Core-Geth client
Each block takes the build most machines need: the x86-64 archive on Linux, Apple Silicon on macOS, the published image for containers. The note under each block says what to change for another architecture. For the full version of any step, and the cases these blocks leave out, read the installation guide on docs.coregeth.com. Check an archive against its checksum and its build attestation before you run it: both commands are at the foot of this page.
Every download here is the latest v1.13 release. If you are replacing a v1.12 node, the upgrade is a security action rather than housekeeping, and that node needs a new P2P key afterwards: what the audits found says which flaws each v1.12 release still carries.
An alltools archive is the same client with the rest of the tools beside it: abigen, clef, evm, rlpdump and the others. To run a node, take the plain archive.
Verify a Core-Geth download
Verify what you downloaded
Two checks, and they answer different questions. The checksum says the file arrived intact. The attestation says which workflow built it, from which commit, which is the question a checksum cannot answer.
# Check a downloaded archive, and where it came from
sha256sum -c core-geth-linux-v1.13.0.zip.sha256 # macOS: shasum -a 256 -c
# core-geth-linux-v1.13.0.zip: OK
gh attestation verify core-geth-linux-v1.13.0.zip --repo ethereumclassic/core-geth
# Loaded digest sha256:... for file://core-geth-linux-v1.13.0.zip
# Loaded 1 attestation from GitHub API
# ✓ Verification succeeded!
#
# - Attestation #1
# - Build repo:..... ethereumclassic/core-geth
# - Build workflow:. .github/workflows/release-packages.yml@refs/tags/v1.13.0sha256sum -c must print OK. If it prints FAILED, delete the file and download it again rather than running it. Between the lines above, the attestation check also prints the policy it enforced: the repository, the workflow identity and the OIDC issuer it requires before it will succeed.
What every release carries
- A checksum beside every file. A
.sha256is published with each archive and each image tarball. - A build attestation on every archive and image. It is minted against a short-lived certificate issued to the workflow run itself, and records which workflow, at which commit, produced the file, so each one traces to the run that built it rather than resting on anyone's word.
- Provenance for the container images. Recorded for the published image index and for each image tarball.
On a first run Windows names the publisher as unknown, and macOS blocks a downloaded binary until it is allowed. The installation guide says how to check an archive and proceed.
How the release artifacts are built and checked