wealdrelay-v0.1.16

Image

ghcr.io/weald-protocol/wealdrelay@sha256:6eee5a44e3503368bf87d7ba8ed5fda8f2175545e74ec714efb64785d227d536

Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:

sha256:da4aec79257f6ff4795111d0ee3737abfe0710ac70e7d2e2e3611afc71ff7b6f

Check it yourself, from this tag, with no artifact of ours involved:

scripts/relay-reproduce.sh --out ./repro

Then compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:

cosign verify \
  --certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/weald-protocol/wealdrelay@sha256:6eee5a44e3503368bf87d7ba8ed5fda8f2175545e74ec714efb64785d227d536

Checksums

Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.

a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a  install.sh
27beda027d700d3bf5c7f6d23faace098bcd97186b0fe50eff070201c0b9eb3f  weald-relay-compose.tar.gz
4381a7e19464c222f9cac212edc7a6170d1d0527ae8881555a4474cb624638dd  wealdrelay-aarch64-apple-darwin.tar.gz
16d3a76b4135ba343c40e28e586e33ed610793268a9025fc59d41291d6a88830  wealdrelay-aarch64-unknown-linux-musl.tar.gz
a96955a6ff6cf3cf3ff383ba6eb15f60f65dde2fe474f2c80ff716f1a64210dc  wealdrelay-x86_64-unknown-linux-musl.tar.gz

What this release does and does not prove is set out in specs/backend/relay/verification.md.