Linux static binaries compiled 2026-10-08. Copy, chmod +x, run. Zero dependencies.
user line in a root-owned path refuses to start instead of silently running as root, and the CLI needs root or membership of group apm. Run sudo apm healconf after installing: it checks your config and every include, explains each setting this version reads differently, and fixes it with a backup beside the file (--check only reports; --yes applies every safe fix). apm upgrade runs the check for you.
Wacatac.B!ml. This is a known false positive: its ML heuristic misfires on statically compiled Go binaries and UPX-compressed executables. It has been reported to Microsoft for review. All other major antivirus engines report these files as clean — see the VirusTotal links below for full scan results.
metadata.json (the SHA-256 of every file above), install.sh and each connector carry an ed25519 signature beside them as <file>.sig. The public key is compiled into every APM binary since v2.10: apm upgrade refuses anything that does not verify, and apm verify <file> <file>.sig checks a download by hand. Key fingerprint (SHA-256 of the public key): f6af819d1b56bcc075a009f5051bb3a4bcf5d0cd962b513d763898a8ca09527f
-----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEAJaQi2HxEjH2ncrimkjGwyyj1XYYwfqTtSPuNT2VIiy8= -----END PUBLIC KEY-----To check with OpenSSL:
openssl pkeyutl -verify -pubin -inkey apm.pub -rawin -in metadata.json -sigfile <(base64 -d metadata.json.sig)
Review batch 4, the last of the October review. The proxy learns which peers to believe about the client IP (trusted_proxies, real_ip_header) and reads forwarded lists from the right; ban_path can no longer be walked around with //, /./, a trailing slash, an encoded letter or a bad escape in the query; a flood of fresh IPs no longer refuses clients with a full rate table. The web GUI always asks for a password (a generated one is in the daemon log and apm gui when none is set), sessions expire, logins back off, and the two root config files merge per key instead of one replacing the other. apm stop no longer deadlocks on a child that IPCs during shutdown, a stray frame byte in log output no longer swallows the log, a stalled child answers 503 instead of holding every request. Local IPC streams are isolated per worker. The connectors move to v3.3.0: large bodies in milliseconds instead of seconds, ordered WebSocket handlers in Node, numeric _status everywhere. The config parser accepts a BOM, a bare key; and diamond includes; saveconf quotes what it writes and keeps dashboard { }; healconf flags a single-value key set twice.
Upgrade notes: set trusted_proxies on listeners behind a proxy; if you rely on the GUI without a password, read the generated one from the daemon log or sudo apm gui, or set gui_password. Details in the timestamped notes beside this file.