Releases: Weald-Protocol/wealdrelay
Release list
wealdrelay-v0.1.26
Image
ghcr.io/weald-protocol/wealdrelay@sha256:321ec7aa158cb7caaf6eb79c38c3f81daaee63e67e9fea122bff14fcd9f76e67
Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:
sha256:387d76a40a62a3396c71595e739ecc9ae3ed4a405feb73acdc827b5421e563eb
Check it yourself, from this tag, with no artifact of ours involved:
scripts/relay-reproduce.sh --out ./reproThen compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:
cosign verify \
--certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/weald-protocol/wealdrelay@sha256:321ec7aa158cb7caaf6eb79c38c3f81daaee63e67e9fea122bff14fcd9f76e67Checksums
Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.
a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a install.sh
303aadf1041b70d575fc3a4ba1a07475df79f112161b2b34d00ce9b6b6d80f99 weald-relay-compose.tar.gz
082184983504feecf9bf062accffb19124ef9ee1a5d96b570ff5d4bf829f3d67 wealdrelay-aarch64-apple-darwin.tar.gz
2827205a8ba7cbc1ee74c129ee82ec597754b12bd6c53418948fb5be370683a5 wealdrelay-aarch64-unknown-linux-musl.tar.gz
805bc47bed64f96b3812212385dd2a42abd0ede5e1aa13d350a80c50637f2f31 wealdrelay-x86_64-unknown-linux-musl.tar.gz
What this release does and does not prove is set out in specs/backend/relay/verification.md.
wealdrelay-v0.1.24
Image
ghcr.io/weald-protocol/wealdrelay@sha256:43ec357210f21dabe955bc390de01235444876df6b8395d247e0229bc09411e5
Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:
sha256:21cfd11bd317084429878f0e25c6600244c964bdfecc97e8851f3cf7ca7c534d
Check it yourself, from this tag, with no artifact of ours involved:
scripts/relay-reproduce.sh --out ./reproThen compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:
cosign verify \
--certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/weald-protocol/wealdrelay@sha256:43ec357210f21dabe955bc390de01235444876df6b8395d247e0229bc09411e5Checksums
Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.
a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a install.sh
2db2962981edeebc0e01c9f45bdfb75cfcc530548f88cffdb91f53433b81b934 weald-relay-compose.tar.gz
c15c6d698ba019332ed98299477c6c32553e4ac4a5a577a6ca26af1eec5dd21f wealdrelay-aarch64-apple-darwin.tar.gz
0e2b186cdb40bb86e83c4b9f37f15bc0ff72ca10fb533ce7fb2b3042301b2481 wealdrelay-aarch64-unknown-linux-musl.tar.gz
ded486b169383c1ec6c8651aa72815bfef16b899fb60b708aadb5d41b9f20a1c wealdrelay-x86_64-unknown-linux-musl.tar.gz
What this release does and does not prove is set out in specs/backend/relay/verification.md.
wealdrelay-v0.1.16
Image
ghcr.io/weald-protocol/wealdrelay@sha256:6eee5a44e3503368bf87d7ba8ed5fda8f2175545e74ec714efb64785d227d536
Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:
sha256:da4aec79257f6ff4795111d0ee3737abfe0710ac70e7d2e2e3611afc71ff7b6f
Check it yourself, from this tag, with no artifact of ours involved:
scripts/relay-reproduce.sh --out ./reproThen compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:
cosign verify \
--certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/weald-protocol/wealdrelay@sha256:6eee5a44e3503368bf87d7ba8ed5fda8f2175545e74ec714efb64785d227d536Checksums
Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.
a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a install.sh
27beda027d700d3bf5c7f6d23faace098bcd97186b0fe50eff070201c0b9eb3f weald-relay-compose.tar.gz
4381a7e19464c222f9cac212edc7a6170d1d0527ae8881555a4474cb624638dd wealdrelay-aarch64-apple-darwin.tar.gz
16d3a76b4135ba343c40e28e586e33ed610793268a9025fc59d41291d6a88830 wealdrelay-aarch64-unknown-linux-musl.tar.gz
a96955a6ff6cf3cf3ff383ba6eb15f60f65dde2fe474f2c80ff716f1a64210dc wealdrelay-x86_64-unknown-linux-musl.tar.gz
What this release does and does not prove is set out in specs/backend/relay/verification.md.
wealdrelay-v0.1.6
Image
ghcr.io/weald-protocol/wealdrelay@sha256:de4059cf1469f032ea6e21f1f5a84378d145c7f3f24e4515c553d4cb774e59b4
Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:
sha256:90508ab779589edf20d5aab3a4b557f358e985d8e5a222b49bfc84cf0e3ec044
Check it yourself, from this tag, with no artifact of ours involved:
scripts/relay-reproduce.sh --out ./reproThen compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:
cosign verify \
--certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/weald-protocol/wealdrelay@sha256:de4059cf1469f032ea6e21f1f5a84378d145c7f3f24e4515c553d4cb774e59b4Checksums
Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.
a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a install.sh
f67e29f627153e938ebff75758f038e5b3421e423c116c9b3a34c4a9fb91e914 weald-relay-compose.tar.gz
ab20c5256412c0b28c3da5064130b73978ce2ad939739e86c5b9cebaf2f60706 wealdrelay-aarch64-apple-darwin.tar.gz
537baa59faee241c778e97da1b40f8c20f6f3c0fb66777ddc13ff9c3e3574a3e wealdrelay-aarch64-unknown-linux-musl.tar.gz
ac55098c4e13e7122e869976a23b01b4b681848d0bff21ac4febe998fb6f51bc wealdrelay-x86_64-unknown-linux-musl.tar.gz
What this release does and does not prove is set out in specs/backend/relay/verification.md.
wealdrelay-v0.1.5
Image
ghcr.io/weald-protocol/wealdrelay@sha256:1bdfb644d684ad8712a011bdb20df3943ca9edd03327dead54c063a15c0a5738
Pin the digest, not the tag. Two independent runners, of two different
architectures, and a clean clone of this tag each built it and agreed:
sha256:1bdfb644d684ad8712a011bdb20df3943ca9edd03327dead54c063a15c0a5738
Check it yourself, from this tag, with no artifact of ours involved:
scripts/relay-reproduce.sh --out ./reproThen compare repro/manifest.json against the digest above. The builder is
pinned to linux/arm64 so that the toolchain is a property of the Dockerfile
rather than of your machine; on an x86_64 host it therefore builds under QEMU and
takes a few hours. That pin is what makes two machines agree at all.
The signature is keyless and checkable by anyone:
cosign verify \
--certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/weald-protocol/wealdrelay@sha256:1bdfb644d684ad8712a011bdb20df3943ca9edd03327dead54c063a15c0a5738Checksums
Every asset below is listed with its SHA-256. install.sh is attached beside
install.sh.sha256: check it before you run it, because it is the one asset here
that executes on your machine.
1ea7dff6b5db2128926d39ebc62ceab1ddf66eb8b131e0d899ec517c4f7235b9 install.sh
62973c43ee99c2844c8b82f60b3ccd9154f9a0842b3ac764f96e7b0cd74aeb95 weald-relay-compose.tar.gz
13d1d130a01bac05c17265f031389e26cf51357e2eb7fb0e603004a21993bafa wealdrelay-aarch64-apple-darwin.tar.gz
5a3da2f4c025af7cbb995cc82b681c3e642179f6ae5c00077c65d9089ab19884 wealdrelay-aarch64-unknown-linux-musl.tar.gz
6abcc4143dd3f2056d60e8a62125998cb50a8d58d8ed85daccb850ae8b532132 wealdrelay-x86_64-unknown-linux-musl.tar.gz
About this release object
The image above was built, pushed, verified and signed by the pipeline. This
release page was assembled by hand from that same run's artifacts, because the
job that writes it failed twice on an unrelated artifact-download error after the
image had already been published, and re-running the whole pipeline would have
rebuilt an image that was already proven. The fix is in main for the next
release.
What this release does and does not prove is set out in
specs/backend/relay/verification.md.