v0.35.0-rc.1

Images

docker pull ghcr.io/controlvar/controlvar:core-0.35.0-rc.1      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.35.0-rc.1      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.35.0-rc.1  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.35.0-rc.1  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.35.0-rc.1 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.35.0-rc.1 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.