Linux static binaries compiled 2026-10-08. Copy, chmod +x, run. Zero dependencies.
user line in a root-owned path refuses to start instead of silently running as root, and the CLI needs root or membership of group apm. Run sudo apm healconf after installing: it checks your config and every include, explains each setting this version reads differently, and fixes it with a backup beside the file (--check only reports; --yes applies every safe fix). apm upgrade runs the check for you.
Wacatac.B!ml. This is a known false positive: its ML heuristic misfires on statically compiled Go binaries and UPX-compressed executables. It has been reported to Microsoft for review. All other major antivirus engines report these files as clean — see the VirusTotal links below for full scan results.
metadata.json (the SHA-256 of every file above), install.sh and each connector carry an ed25519 signature beside them as <file>.sig. The public key is compiled into every APM binary since v2.10: apm upgrade refuses anything that does not verify, and apm verify <file> <file>.sig checks a download by hand. Key fingerprint (SHA-256 of the public key): f6af819d1b56bcc075a009f5051bb3a4bcf5d0cd962b513d763898a8ca09527f
-----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEAJaQi2HxEjH2ncrimkjGwyyj1XYYwfqTtSPuNT2VIiy8= -----END PUBLIC KEY-----To check with OpenSSL:
openssl pkeyutl -verify -pubin -inkey apm.pub -rawin -in metadata.json -sigfile <(base64 -d metadata.json.sig)
Review batch 3. Every file apm upgrade acts on — the release manifest, the installer, the connectors — now carries an ed25519 signature, and the public key is compiled into the binary: an upgrade refuses anything the maintainer did not sign, a downgrade is refused unless asked for, a specific version can be installed, and the last three releases stay published as rollback targets. apm verify checks a file by hand; the connectors' self-update uses it.
Nothing to configure. The upgrade to 2.10 is the last one that trusts TLS alone; every one after it is verified by the binary you already have.
Details in the timestamped note beside this file.