Use a Free account for evaluation and the portal for release artifacts.

Current release catalog

The customer portal is the source of truth for current Cerberus releases, artifact names, checksums, signatures, SBOMs, advisories, and release notes.

What the Free account gate does

• requires explicit agreement to the current account terms before portal access
• records the acceptance on the server with the customer account and entitlement
• keeps installer access behind login instead of sending evaluators to a durable public object URL

What belongs in the portal

• customer-specific access to release bundles, checksums, signatures, and SBOMs
• license retrieval through `license.json` and matching `cerb1:` strings
• support context, entitlement history, documents, and release notes for the customer account

Trust center metadata

• release advisories are published with each version so operators can judge urgency before rollout
• detached signatures and SBOMs can be shipped alongside the bundle when your release process has them ready
• verification instructions are versioned release metadata, not copy pasted docs text

Why checksums matter

• verify the bundle you received before rollout or internal redistribution
• tie deployment approval to a specific version and digest
• treat checksum validation as part of normal change review for self-hosted software

Verification guidance

• download the installer and matching checksum from the same portal release record
• compare the published digest before staging or redistributing the bundle internally
• use signatures and SBOMs from the portal when they are published for that version

Release notes before deployment

• read the release notes before production rollout
• stage high-impact changes where feasible
• keep backups, exports, and rollback plans under your own operational control

What this gate does not replace

• login-gated downloads reduce accidental sharing, but downloaded artifacts still need internal handling rules
• for the strongest boundary, keep backing object storage private and keep issued URLs short-lived
• portal-side logging complements, but does not replace, your own release governance