Strata Server — downloads

Public downloads and install scripts for Strata Server, which publishes Parquet and GeoParquet datasets as ArcGIS REST services (FeatureServer and VectorTileServer) using DuckDB.

Looking for the download page? It is at https://tabaqat.net/platform#download.

This repository holds only the release artifacts and the two install scripts. The source lives in a private repository; its release pipeline publishes the compiled bundles here.

Install

# macOS / Linux
curl -fsSL https://get.tabaqat.net/install.sh | sh

# ...or without curl
wget -qO- https://get.tabaqat.net/install.sh | sh

# Windows (PowerShell)
irm https://get.tabaqat.net/install.ps1 | iex

Package managers:

# Homebrew — macOS and Linux. The two-argument tap form is required because
# this repo is not named `homebrew-strata`; it holds the releases as well.
brew tap tabaqatdev/strata https://github.com/tabaqatdev/strata-server-release
brew install tabaqatdev/strata/strata-server

# Scoop — Windows
scoop bucket add strata https://github.com/tabaqatdev/strata-server-release
scoop install strata-server

The installer downloads the bundle for your platform, verifies its SHA-256 against the release's SHA256SUMS, installs to ~/.strata (%LOCALAPPDATA%\Strata on Windows), puts a strata command on your PATH, and starts the server on http://localhost:8765.

Sign in with admin / strata and change it after the first login.

Verify a download

Every release ships SHA256SUMS, signed with Sigstore cosign under the GitHub Actions identity that built it — no key to distribute and no certificate to trust.

sha256sum -c SHA256SUMS --ignore-missing

cosign verify-blob SHA256SUMS \
  --signature   SHA256SUMS.sig \
  --certificate SHA256SUMS.pem \
  --certificate-identity-regexp '^https://github.com/tabaqatdev/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Windows SmartScreen shows an "unrecognised publisher" warning on files downloaded through a browser, because the Windows build is not yet code-signed. Installing via Scoop or the PowerShell command avoids that path. On macOS, installs through curl or Homebrew are never quarantined — macOS only sets the quarantine attribute on files written by a browser.

Upgrading

Re-run the same install command. Only app/ is replaced; your app-config/ (users, tokens, signing key), layers.toml and data/ are preserved. Homebrew and Scoop follow the same rule.

Uninstalling

Delete ~/.strata (or %LOCALAPPDATA%\Strata) and the strata shim in ~/.local/bin (or %LOCALAPPDATA%\Programs\Strata\bin). Package-manager installs remove with brew uninstall strata-server or scoop uninstall strata-server. Nothing is installed system-wide and no services are registered without your asking.

What is in this repository

Path	Purpose
install.sh	the macOS / Linux installer, piped into sh
install.ps1	the Windows installer, piped into iex
Formula/strata-server.rb	Homebrew formula, written by the release pipeline
bucket/strata-server.json	Scoop manifest, written by the release pipeline
Releases	the platform bundles, SHA256SUMS, and its cosign signature

The formula installs the whole bundle into libexec and writes a bin/strata-server wrapper that seeds ~/.strata on first run and executes from there. That indirection is load-bearing: Homebrew replaces the Cellar wholesale on every brew upgrade, so config.db (users, tokens, ACLs) and secret.key must not live inside it.

get.tabaqat.net/install.sh and /install.ps1 are 302 redirects to the raw files in this repository, so whatever is on main is what users run. Treat a change here as immediately live — there is no staging step.

Editing the install scripts

Two constraints they must keep:

• They hard-code the release asset naming (strata-<version>-<os>-<arch>.<ext>) produced by the private repo's release workflow. If an asset is ever renamed there, these break for every user until updated to match.

• install.sh must stay POSIX sh. It runs under dash on Debian/Ubuntu and ash on Alpine, not just bash. Check before pushing:

  sh -n install.sh && dash -n install.sh && shellcheck --shell=sh install.sh

  .gitattributes pins it to LF: a CRLF checkout makes bash read set -eu\r and every install dies on line 1.

Releases

See Releases for every published version and its changelog.