wealdrelay-v0.1.24

Image

ghcr.io/weald-protocol/wealdrelay@sha256:43ec357210f21dabe955bc390de01235444876df6b8395d247e0229bc09411e5

Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:

sha256:21cfd11bd317084429878f0e25c6600244c964bdfecc97e8851f3cf7ca7c534d

Check it yourself, from this tag, with no artifact of ours involved:

scripts/relay-reproduce.sh --out ./repro

Then compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:

cosign verify \
  --certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/weald-protocol/wealdrelay@sha256:43ec357210f21dabe955bc390de01235444876df6b8395d247e0229bc09411e5

Checksums

Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.

a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a  install.sh
2db2962981edeebc0e01c9f45bdfb75cfcc530548f88cffdb91f53433b81b934  weald-relay-compose.tar.gz
c15c6d698ba019332ed98299477c6c32553e4ac4a5a577a6ca26af1eec5dd21f  wealdrelay-aarch64-apple-darwin.tar.gz
0e2b186cdb40bb86e83c4b9f37f15bc0ff72ca10fb533ce7fb2b3042301b2481  wealdrelay-aarch64-unknown-linux-musl.tar.gz
ded486b169383c1ec6c8651aa72815bfef16b899fb60b708aadb5d41b9f20a1c  wealdrelay-x86_64-unknown-linux-musl.tar.gz

What this release does and does not prove is set out in specs/backend/relay/verification.md.