Appliance Install Media

Signed, bootable, verifiable.

Download a ready-to-deploy Mediacast appliance image — QCOW2 for Proxmox and KVM, OVA for VMware ESXi and vCenter. Every image is cryptographically signed with the Mediacast release key, so you can prove we built exactly what you downloaded before you ever boot it.

Access is tied to your Mediacast entitlement. Sign in to see the images available to you. First boot binds the appliance to your platform and arms in-place managed updates — no rebuilds, no checkout, no registry tokens on the box.

Browse Images ↓ How to Verify →

Available Images

Your appliance images.

Each release lists both disk formats with the published SHA-256 and signature. Pick the format your hypervisor imports, then verify it with the steps below before you deploy.

This page needs JavaScript to list available images. For a download link without it, contact us.

Verify Before You Deploy

Prove we built it.

An appliance image runs your venue. Don’t trust it because it came from a Mediacast URL — trust it because the signature checks out. Two steps: a checksum to catch a bad download, and a signature to prove provenance.

1

Checksum — catch a corrupt download

Compute the SHA-256 of the file you downloaded and compare it to the value shown with the download (also in the release’s install-media-manifest.json). They must match exactly.

# Replace with the file you downloaded:
sha256sum mediacaster-appliance-<version>.ova
# Compare the output to the SHA-256 shown on this page.

2

Signature — prove Mediacast built it

The signature is an ECDSA-P256 signature over the file’s SHA-256 digest, made with the Mediacast release key (kid release-2026) — the same key every appliance uses to verify its own in-place updates. Rebuild the public key from our first-party keyring and verify. Verified OK means the bytes are genuinely ours.

# 1. Fetch the public key (served first-party over TLS):
curl -s https://www.mediacastnet.com/.well-known/mediacast-release-keys.json \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["release-2026"])' > point.b64

# 2. Rebuild the P-256 public key as a PEM:
python3 - "$(cat point.b64)" > pub.der <<'PY'
import sys, base64
point = base64.b64decode(sys.argv[1])
open(1,'wb').write(bytes.fromhex('3059301306072a8648ce3d020106082a8648ce3d030107034200') + point)
PY
openssl pkey -pubin -inform DER -in pub.der -out pub.pem

# 3. Verify the signature (shown with the download) over the file's sha256 hex:
SHA=$(sha256sum mediacaster-appliance-<version>.ova | cut -d' ' -f1)
printf '%s' "$SHA" > digest.txt
printf '%s' '<signature-base64-from-this-page>' | base64 -d > sig.der
openssl dgst -sha256 -verify pub.pem -signature sig.der digest.txt
# -> Verified OK

The public key is published at /.well-known/mediacast-release-keys.json. The private key never leaves our KMS — we can sign, no one can forge.

Deploy

Pick your format.

OVA — VMware

Imports into ESXi, vCenter, and Workstation 6.7+. Deploy the OVA, then paste your per-appliance cloud-init userdata into vApp Options → user-data (or set guestinfo.userdata via govc). Baseline 4 vCPU / 8 GB; bridge the NIC to your AV VLAN — multicast needs L2 reachability.

QCOW2 — Proxmox / KVM

Use the QCOW2 directly on Proxmox, KVM, or libvirt. Provide cloud-init userdata through the platform’s NoCloud datasource (on Proxmox, the cloud-init drive). Same /etc/mediacaster/appliance.env identity contract as the OVA.

First boot binds the appliance to one identity and arms the host update agent; from then on it updates itself in place over HTTPS — signed container swaps, health-gated, with automatic rollback. You never re-download an image to update.