Installation

Requirements#

Windows 10/11 — or, experimentally, 64-bit Debian or Ubuntu on x86-64 or Arm; see Linux build, which covers installing there
.NET 10 SDK or newer — only to build from source; released binaries are self-contained

Install#

With winget#

winget install RavensPort

The full app — Proton Pass and mTLS included. Upgrades come with winget upgrade, and winget uninstall RavensPort removes it.

This is the same Inno installer the Releases page carries, so everything in From a release below applies to it: per-user, no elevation prompt, no .NET to install. winget verifies the download against the SHA256 in the published manifest before running it. The manifests live in packaging/winget/, versioned with the code that built the installer they describe.

One thing worth knowing: RavensPort will not install over a copy of itself that is running, so close it from the tray before winget upgrade. It fails cleanly rather than silently — winget reports the package as in use and tells you to close it.

From a release#

Download RavensPort-Setup-<version>.exe from the Releases page and run it. It installs per-user — no elevation prompt, no .NET install, no extraction — and leaves a Start menu shortcut and an Add or Remove Programs entry behind.

Windows will warn about an unknown publisher — the installer is not Authenticode-signed. Instead every release carries a build provenance attestation recording the workflow, commit, and runner that produced it. Verify with the GitHub CLI:

gh attestation verify RavensPort-Setup-<version>.exe --repo abishekvupputur/ravensPort

A pass means the file is byte-for-byte what CI built from this repository.

From the Microsoft Store#

apps.microsoft.com/detail/9PBNQH53L61D

Installs and updates through the Store, and raises no unknown-publisher warning: Microsoft signs the package at ingestion, which is the one thing the installer above cannot offer.

Two features are missing from it, because Store certification rejected them:

	winget / installer	Store
1Password, single use	yes	yes
Routes, MCP funnels, OAuth2, proxy keys, activity log	yes	yes
Proton Pass as a vault backend	yes	no
mTLS and client certificate generation	yes	no

Policy 10.1.5 read the setup page's Proton Pass card as promoting software acquired outside the Store; 10.2.10 and 10.2.10.1 read Settings → Generate new certificate as certificate installation. Neither is hidden in the Store build — the code behind them is not compiled into it.

Use winget install RavensPort if you need either. Both builds read the same vault, so you can run the Store one on this machine and the full app on another; a Store install that finds mTLS switched on serves plain http://127.0.0.1 and says so in the activity log, and every caller still needs its endpoint's proxy key. A vault last written by the Proton Pass backend is simply not read there.

See docs/STORE-MSIX.md for how the two builds are produced.

From source#

clean-build.bat

Stops any running instance, wipes bin/obj, builds the 1Password native library (it needs Go and a C compiler for cgo), runs the tests, publishes, builds the installer into dist\, and launches. The installer step needs Inno Setup (winget install JRSoftware.InnoSetup); run clean-build.bat nosetup to skip it when you only want to run the app. Look for the RavensPort icon in the system tray — left-click opens the window, right-click gives a menu.

On Linux, build from source with packaging/build-deb.sh — see Linux build.

The proxy listens on http://127.0.0.1:5559 by default (changeable in Settings; requires a restart).

Edit this page on the wiki Request support · Report vulnerabilities privately