wealdrelay-v0.1.26

Image

ghcr.io/weald-protocol/wealdrelay@sha256:321ec7aa158cb7caaf6eb79c38c3f81daaee63e67e9fea122bff14fcd9f76e67

Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:

sha256:387d76a40a62a3396c71595e739ecc9ae3ed4a405feb73acdc827b5421e563eb

Check it yourself, from this tag, with no artifact of ours involved:

scripts/relay-reproduce.sh --out ./repro

Then compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:

cosign verify \
  --certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/weald-protocol/wealdrelay@sha256:321ec7aa158cb7caaf6eb79c38c3f81daaee63e67e9fea122bff14fcd9f76e67

Checksums

Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.

a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a  install.sh
303aadf1041b70d575fc3a4ba1a07475df79f112161b2b34d00ce9b6b6d80f99  weald-relay-compose.tar.gz
082184983504feecf9bf062accffb19124ef9ee1a5d96b570ff5d4bf829f3d67  wealdrelay-aarch64-apple-darwin.tar.gz
2827205a8ba7cbc1ee74c129ee82ec597754b12bd6c53418948fb5be370683a5  wealdrelay-aarch64-unknown-linux-musl.tar.gz
805bc47bed64f96b3812212385dd2a42abd0ede5e1aa13d350a80c50637f2f31  wealdrelay-x86_64-unknown-linux-musl.tar.gz

What this release does and does not prove is set out in specs/backend/relay/verification.md.