v1.2.10

Community release v1.2.10

• Source commit: ed25ec9debf90e366959c547605ec2f2a0bd5afe
• Images retagged from CI core-build-inventory digests (write-once)
• Public compose smoke test passed
• core-manifest.yaml attached (image digests, engine pins, schema ledger)
• CycloneDX SBOMs attached for all six images × linux/amd64 + linux/arm64 (12 assets: sbom-<component>-v1.2.10-linux-amd64|arm64.cdx.json)
• Image index manifests signed with Cosign (GitHub Actions OIDC / Fulcio keyless)

Verify Cosign signatures

IDENTITY_RE='^https://github\.com/SiriusScan/Sirius/\.github/workflows/publish-release-image-tags\.yml@refs/heads/main$'
ISSUER='https://token.actions.githubusercontent.com'
for c in sirius-ui sirius-api sirius-engine sirius-postgres sirius-rabbitmq sirius-valkey; do
  digest=$(crane digest "ghcr.io/siriusscan/${c}:v1.2.10")
  cosign verify --certificate-identity-regexp "${IDENTITY_RE}" --certificate-oidc-issuer "${ISSUER}" \
    "ghcr.io/siriusscan/${c}@${digest}"
done

Install with IMAGE_TAG=v1.2.10 against public GHCR.