wealdrelay-v0.1.5

Image

ghcr.io/weald-protocol/wealdrelay@sha256:1bdfb644d684ad8712a011bdb20df3943ca9edd03327dead54c063a15c0a5738

Pin the digest, not the tag. Two independent runners, of two different
architectures, and a clean clone of this tag each built it and agreed:

sha256:1bdfb644d684ad8712a011bdb20df3943ca9edd03327dead54c063a15c0a5738

Check it yourself, from this tag, with no artifact of ours involved:

scripts/relay-reproduce.sh --out ./repro

Then compare repro/manifest.json against the digest above. The builder is
pinned to linux/arm64 so that the toolchain is a property of the Dockerfile
rather than of your machine; on an x86_64 host it therefore builds under QEMU and
takes a few hours. That pin is what makes two machines agree at all.

The signature is keyless and checkable by anyone:

cosign verify \
  --certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/weald-protocol/wealdrelay@sha256:1bdfb644d684ad8712a011bdb20df3943ca9edd03327dead54c063a15c0a5738

Checksums

Every asset below is listed with its SHA-256. install.sh is attached beside
install.sh.sha256: check it before you run it, because it is the one asset here
that executes on your machine.

1ea7dff6b5db2128926d39ebc62ceab1ddf66eb8b131e0d899ec517c4f7235b9  install.sh
62973c43ee99c2844c8b82f60b3ccd9154f9a0842b3ac764f96e7b0cd74aeb95  weald-relay-compose.tar.gz
13d1d130a01bac05c17265f031389e26cf51357e2eb7fb0e603004a21993bafa  wealdrelay-aarch64-apple-darwin.tar.gz
5a3da2f4c025af7cbb995cc82b681c3e642179f6ae5c00077c65d9089ab19884  wealdrelay-aarch64-unknown-linux-musl.tar.gz
6abcc4143dd3f2056d60e8a62125998cb50a8d58d8ed85daccb850ae8b532132  wealdrelay-x86_64-unknown-linux-musl.tar.gz

About this release object

The image above was built, pushed, verified and signed by the pipeline. This
release page was assembled by hand from that same run's artifacts, because the
job that writes it failed twice on an unrelated artifact-download error after the
image had already been published, and re-running the whole pipeline would have
rebuilt an image that was already proven. The fix is in main for the next
release.

What this release does and does not prove is set out in
specs/backend/relay/verification.md.