Release v4.6.5

Release v4.6.5

This release includes:

• 🐳 Docker image (amd64)
• 📱 Flutter Android APK with provenance attestation
• 🔐 Signed images and artifacts using Sigstore cosign
• 📋 Software Bill of Materials (SBOM) in CycloneDX format
• ✅ Build provenance attestations
• 🔍 SHA256 checksums for all artifacts

Mobile App

We recommend downloading from Google Play. GhostClass enforces Firebase App Check (Play Integrity), and Play-distributed builds provide the most reliable attestation path.

Docker Images

Pull by Immutable Content Hash (Recommended)

# Web App
docker pull ghcr.io/devakesu/ghostclass@sha256:b11c1f87d9c9ce009bcdd87d1735f5f8566bc0d0feb4f1a2601eafef35b3886c

# Database Backup Service
docker pull ghcr.io/devakesu/ghostclass-backup@sha256:cd4a00437efcd582148330f61798d7b07e6ffd276b826e8cd7de172e6d529662

Pull by Immutable Commit SHA

# Web App
docker pull ghcr.io/devakesu/ghostclass:d56eb7fc46d810e443e81d4da024b913a3268995

# Database Backup Service
docker pull ghcr.io/devakesu/ghostclass-backup:d56eb7fc46d810e443e81d4da024b913a3268995

Pull by Version Tag

# Web App
docker pull ghcr.io/devakesu/ghostclass:v4.6.5

# Database Backup Service
docker pull ghcr.io/devakesu/ghostclass-backup:v4.6.5

Image Digest: sha256:b11c1f87d9c9ce009bcdd87d1735f5f8566bc0d0feb4f1a2601eafef35b3886c
Commit SHA: d56eb7fc46d810e443e81d4da024b913a3268995

Verification

See VERIFY.md for detailed verification instructions.

Quick Verification

# Verify image signature by digest
cosign verify \
  --certificate-identity-regexp="^https://github.com/devakesu/GhostClass" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/devakesu/ghostclass@sha256:b11c1f87d9c9ce009bcdd87d1735f5f8566bc0d0feb4f1a2601eafef35b3886c

# Verify attestation
gh attestation verify oci://ghcr.io/devakesu/ghostclass@sha256:b11c1f87d9c9ce009bcdd87d1735f5f8566bc0d0feb4f1a2601eafef35b3886c --owner devakesu

---

Full Changelog: v4.6.2...v4.6.5