Immutable
release. Only release title and notes can be modified.
Channel: stable. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).