wealdrelay-v0.1.6

Image

ghcr.io/weald-protocol/wealdrelay@sha256:de4059cf1469f032ea6e21f1f5a84378d145c7f3f24e4515c553d4cb774e59b4

Pin the digest, not the tag. Two independent runners and a clean clone of this tag each built it and agreed:

sha256:90508ab779589edf20d5aab3a4b557f358e985d8e5a222b49bfc84cf0e3ec044

Check it yourself, from this tag, with no artifact of ours involved:

scripts/relay-reproduce.sh --out ./repro

Then compare repro/manifest.json against the digest above. The signature is keyless and checkable by anyone:

cosign verify \
  --certificate-identity-regexp "^https://github.com/Weald-Protocol/wealdrelay/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/weald-protocol/wealdrelay@sha256:de4059cf1469f032ea6e21f1f5a84378d145c7f3f24e4515c553d4cb774e59b4

Checksums

Every asset below is listed with its SHA-256. install.sh is attached beside install.sh.sha256: check it before you run it, because it is the one asset here that executes on your machine.

a99b9df4dab6f87fc4567ceeb28e1802ec253399e0cc3d42a624f87ed7dbe30a  install.sh
f67e29f627153e938ebff75758f038e5b3421e423c116c9b3a34c4a9fb91e914  weald-relay-compose.tar.gz
ab20c5256412c0b28c3da5064130b73978ce2ad939739e86c5b9cebaf2f60706  wealdrelay-aarch64-apple-darwin.tar.gz
537baa59faee241c778e97da1b40f8c20f6f3c0fb66777ddc13ff9c3e3574a3e  wealdrelay-aarch64-unknown-linux-musl.tar.gz
ac55098c4e13e7122e869976a23b01b4b681848d0bff21ac4febe998fb6f51bc  wealdrelay-x86_64-unknown-linux-musl.tar.gz

What this release does and does not prove is set out in specs/backend/relay/verification.md.