Releases

Every release is one tag, vX.Y.Z (v0.2.1), and holds every binary at that one version: the compositor with scoot msg, the wallpaper daemon, the bar, the launcher and the notification daemon. The release workflow builds and publishes it; nothing is done by hand. To decide whether versions work together, read Versions and compatibility first.

Which file to download

A release holds one set of files per architecture (x86_64-linux, aarch64-linux), plus the sources everything was built from:

File	What it is
scoot-<version>-<arch>	The compositor (plus the scoot msg client, the only client)
scootbg-<version>-<arch>	The wallpaper daemon
scootbar-<version>-<arch>	The status bar
scootlaunch-<version>-<arch>	The application launcher
scootnotify-<version>-<arch>	The notification daemon
scoot-<version>-vendored.tar.gz	The exact tagged tree plus vendor/ (every dependency), .cargo/config.toml, THIRD-PARTY-LICENSES and OFFLINE-BUILD.txt
sbom-scoot-<version>.cyclonedx.json	The locked dependencies of every shipped binary (their union), CycloneDX 1.3
SHA256SUMS	The checksum of every file above

The binaries are the default feature build: one binary that scans out from the GPU on real hardware and renders on the CPU everywhere else (the GPU scanout tier is compiled in and loads the GPU libraries at run time with dlopen, so the same binary starts with and without a GPU stack installed), with xwayland compiled in (it needs the Xwayland binary on PATH at run time to drive X11 apps). They are built with cargo from the vendored tree on Debian 12 (glibc 2.36) with Rust 1.97.0 (the rustup pin in release.yml), so they run on any glibc distro at or past that floor. For a CPU-only build with no GPU or X11 code at all, build from the vendored tarball (package scoot offline) or take the Nix packages.

The easy way to get them: the install script picks the right files for your machine, checks them against SHA256SUMS, and installs the session files beside them.

Tagged releases only

The install script installs tagged releases: by default the newest tag, or the version --version names. When no tagged release exists yet, the script fails instead of installing main; it never follows a moving build. To run main, use the Nix flake: every merge to main lands tested binaries in the Cachix cache, with the flake on FlakeHub (rolling release). See Install. Verify a file with --signer-workflow scoot-sh/scoot/.github/workflows/release.yml in the command below.

A build that is not a release says how far past one it is: scoot --version prints scoot 0.2.1+14.g615608c (ipc protocol 11). The Nix flake’s rolling release is numbered 0.3.<commits on main>, so it sorts above every 0.2.x tag.

Run them on your distro

The bar, the wallpaper daemon and the notification daemon need nothing but a C library. The launcher needs libxkbcommon. The compositor needs five system libraries, taken from ldd:

Distro	Install (compositor only)
Debian 12 / Ubuntu 24.04 and newer	apt install libseat1 libinput10 libxkbcommon0 libudev1 libpixman-1-0
Fedora 43 and newer	dnf install libseat libinput libxkbcommon systemd-libs pixman
Arch	pacman -S seatd libinput libxkbcommon systemd-libs pixman

Older releases work if they provide the same sonames (libinput.so.10, libseat.so.1, libudev.so.1, libpixman-1.so.0, libxkbcommon.so.0); a musl distro (Alpine) is not covered, because these are glibc binaries. Check what you have first:

chmod +x scoot-0.2.1-x86_64-linux   # release downloads carry no executable bit
./scoot-0.2.1-x86_64-linux --version

It prints one line and exits without starting anything. If a library is missing, that command names it.

Verify a download

Symptom: you want to know the file you fetched is the file the release built.

Check the checksum first (it catches a corrupt or swapped download), then the provenance (it ties the file to the public build that made it).

sha256sum -c SHA256SUMS

Every line must report OK. Then the provenance: each file carries a keyless GitHub attestation, so there is no signing key to fetch or rotate. You need the gh CLI (the flags below match gh attestation verify --help at gh 2.92.0 and 2.100.0):

gh attestation verify scoot-0.2.1-x86_64-linux --owner scoot-sh --signer-workflow scoot-sh/scoot/.github/workflows/release.yml

Pinning --signer-workflow matters: --owner alone accepts a provenance attestation minted by any workflow in the org.

A verified file prints who built it (the release workflow, on the tag’s commit) and what went in. The SBOM is plain JSON; read it with jq:

jq '.components | length' sbom-scoot-0.2.1.cyclonedx.json
jq -r '.components[].name' sbom-scoot-0.2.1.cyclonedx.json | sort | head

Where releases come from

A tag on main starts the release workflow: it refuses a tag that disagrees with the workspace version, a tag not on main, and a re-publish of an existing release; builds the tarball, both architectures, the SBOM and the checksums; and publishes the GitHub Release with that version’s changelog section as its notes. Nix users can skip the verification section above: every merge to main lands tested binaries in the Cachix cache, with the flake on FlakeHub. See Install. Cutting a release is a maintainer task, described on the cut a release page.