Skip to content

Releases: irashack/molebridge

Release list

v0.9.2

v0.9.2 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 05:50
Immutable release. Only release title and notes can be modified.
v0.9.2
cd60562

Molebridge v0.9.2, promoted without rebuilding from candidate v0.9.2-rc.1, which passed live acceptance (experimental software; see the README).

Source commit: cd605622cf73586f9a391d6689b9dae2087bc04d
Image index: ghcr.io/irashack/molebridge:v0.9.2@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b
Bundle: molebridge-v0.9.2.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 the image index and each architecture's manifest
Live-acceptance attestation https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 molebridge-v0.9.2.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: cd605622cf73586f9a391d6689b9dae2087bc04d.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.2.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.2.tar.gz
gh attestation verify molebridge-v0.9.2.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.2.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha cd605622cf73586f9a391d6689b9dae2087bc04d \
  ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest cd605622cf73586f9a391d6689b9dae2087bc04d \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify the live-acceptance attestation, and read its result, commit and coverage:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
  --format json | jq '.[].verificationResult.statement.predicate'

    result must be passed, commit must be cd605622cf73586f9a391d6689b9dae2087bc04d, and the platforms, providers, kinds and drills must be the ones you need.

  5. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:fcb991b7c7154db29065c1b552c0b5753f396704bb4ae9f4613a1f02078ea67b sha256:4d82cf1797556cb7ae3a7db1d59be117543354bb7fb0fe3aa354e5ebee376c10; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  6. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:fcb991b7c7154db29065c1b552c0b5753f396704bb4ae9f4613a1f02078ea67b, linux/arm64 sha256:4d82cf1797556cb7ae3a7db1d59be117543354bb7fb0fe3aa354e5ebee376c10.

Assets 7
Loading

v0.9.2-rc.1 (release candidate)

v0.9.2-rc.1 (release candidate) Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 03:40
Immutable release. Only release title and notes can be modified.
v0.9.2-rc.1
cd60562

Release candidate v0.9.2-rc.1. It has not passed live acceptance; do not install it on an exit you rely on.

Source commit: cd605622cf73586f9a391d6689b9dae2087bc04d
Image index: ghcr.io/irashack/molebridge:v0.9.2-rc.1@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b
Bundle: molebridge-v0.9.2-rc.1.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 the image index and each architecture's manifest
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 molebridge-v0.9.2-rc.1.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: cd605622cf73586f9a391d6689b9dae2087bc04d.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.2-rc.1.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.2-rc.1.tar.gz
gh attestation verify molebridge-v0.9.2-rc.1.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.2-rc.1.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha cd605622cf73586f9a391d6689b9dae2087bc04d \
  ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest cd605622cf73586f9a391d6689b9dae2087bc04d \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:fcb991b7c7154db29065c1b552c0b5753f396704bb4ae9f4613a1f02078ea67b sha256:4d82cf1797556cb7ae3a7db1d59be117543354bb7fb0fe3aa354e5ebee376c10; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  5. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:fcb991b7c7154db29065c1b552c0b5753f396704bb4ae9f4613a1f02078ea67b, linux/arm64 sha256:4d82cf1797556cb7ae3a7db1d59be117543354bb7fb0fe3aa354e5ebee376c10.

Loading

v0.9.1

v0.9.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 01:59
v0.9.1
df163f2

Molebridge v0.9.1, promoted without rebuilding from candidate v0.9.1-rc.3, which passed live acceptance (experimental software; see the README).

Source commit: df163f24ae4b4cb4dac310dbed770baf004b68d2
Image index: ghcr.io/irashack/molebridge:v0.9.1@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a
Bundle: molebridge-v0.9.1.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 the image index and each architecture's manifest
Live-acceptance attestation https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 molebridge-v0.9.1.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: df163f24ae4b4cb4dac310dbed770baf004b68d2.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.1.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.1.tar.gz
gh attestation verify molebridge-v0.9.1.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.1.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha df163f24ae4b4cb4dac310dbed770baf004b68d2 \
  ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest df163f24ae4b4cb4dac310dbed770baf004b68d2 \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify the live-acceptance attestation, and read its result, commit and coverage:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
  --format json | jq '.[].verificationResult.statement.predicate'

    result must be passed, commit must be df163f24ae4b4cb4dac310dbed770baf004b68d2, and the platforms, providers, kinds and drills must be the ones you need.

  5. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:6028e0d37ccaa1e8d181b59b8febd564605032cd557e4e225cebd1f521513c20 sha256:76d773f21e7dd7ae39fb9d693e1afc1dbd6f6f2aff73ad14a8bf5a6386b6298a; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  6. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:6028e0d37ccaa1e8d181b59b8febd564605032cd557e4e225cebd1f521513c20, linux/arm64 sha256:76d773f21e7dd7ae39fb9d693e1afc1dbd6f6f2aff73ad14a8bf5a6386b6298a.

Loading

v0.9.1-rc.3 (release candidate)

v0.9.1-rc.3 (release candidate) Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 01:11
v0.9.1-rc.3
df163f2

Release candidate v0.9.1-rc.3. It has not passed live acceptance; do not install it on an exit you rely on.

Source commit: df163f24ae4b4cb4dac310dbed770baf004b68d2
Image index: ghcr.io/irashack/molebridge:v0.9.1-rc.3@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a
Bundle: molebridge-v0.9.1-rc.3.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 the image index and each architecture's manifest
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 molebridge-v0.9.1-rc.3.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: df163f24ae4b4cb4dac310dbed770baf004b68d2.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.1-rc.3.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.1-rc.3.tar.gz
gh attestation verify molebridge-v0.9.1-rc.3.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.1-rc.3.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha df163f24ae4b4cb4dac310dbed770baf004b68d2 \
  ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest df163f24ae4b4cb4dac310dbed770baf004b68d2 \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:6028e0d37ccaa1e8d181b59b8febd564605032cd557e4e225cebd1f521513c20 sha256:76d773f21e7dd7ae39fb9d693e1afc1dbd6f6f2aff73ad14a8bf5a6386b6298a; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  5. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:6028e0d37ccaa1e8d181b59b8febd564605032cd557e4e225cebd1f521513c20, linux/arm64 sha256:76d773f21e7dd7ae39fb9d693e1afc1dbd6f6f2aff73ad14a8bf5a6386b6298a.

Loading

v0.9.1-rc.2 (release candidate)

v0.9.1-rc.2 (release candidate) Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 23:46
v0.9.1-rc.2
690f13a

Release candidate v0.9.1-rc.2. It has not passed live acceptance; do not install it on an exit you rely on.

Source commit: 690f13a2922793c56a754c8d59fc4501855e0f83
Image index: ghcr.io/irashack/molebridge:v0.9.1-rc.2@sha256:43a4224a044885769c219b17f73d4996010eee888f99199bbbc98d06ba29f3f9
Bundle: molebridge-v0.9.1-rc.2.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 the image index and each architecture's manifest
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 molebridge-v0.9.1-rc.2.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: 690f13a2922793c56a754c8d59fc4501855e0f83.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.1-rc.2.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.1-rc.2.tar.gz
gh attestation verify molebridge-v0.9.1-rc.2.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.1-rc.2.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha 690f13a2922793c56a754c8d59fc4501855e0f83 \
  ghcr.io/irashack/molebridge@sha256:43a4224a044885769c219b17f73d4996010eee888f99199bbbc98d06ba29f3f9

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:43a4224a044885769c219b17f73d4996010eee888f99199bbbc98d06ba29f3f9 --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest 690f13a2922793c56a754c8d59fc4501855e0f83 \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:334b2cdb5ea6702465e8484a445bc44fa830d5f2064b1f8fff2cccdb47f440f3 sha256:641c01831eef3445f98b7338a3b19a078af43c6f18c4032efbbb0483eba22ec2; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.2 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  5. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:334b2cdb5ea6702465e8484a445bc44fa830d5f2064b1f8fff2cccdb47f440f3, linux/arm64 sha256:641c01831eef3445f98b7338a3b19a078af43c6f18c4032efbbb0483eba22ec2.

Loading

v0.9.1-rc.1 (release candidate)

v0.9.1-rc.1 (release candidate) Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 22:46
v0.9.1-rc.1
728b793

Release candidate v0.9.1-rc.1. It has not passed live acceptance; do not install it on an exit you rely on.

Source commit: 728b7932f32b932feb1daf51d9a635ee94062b20
Image index: ghcr.io/irashack/molebridge:v0.9.1-rc.1@sha256:cdf5345b0781c50939c8a2634055c6935061c38a9c40ccaf22673ab931599f84
Bundle: molebridge-v0.9.1-rc.1.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 the image index and each architecture's manifest
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 molebridge-v0.9.1-rc.1.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: 728b7932f32b932feb1daf51d9a635ee94062b20.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.1-rc.1.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.1-rc.1.tar.gz
gh attestation verify molebridge-v0.9.1-rc.1.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.1-rc.1.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha 728b7932f32b932feb1daf51d9a635ee94062b20 \
  ghcr.io/irashack/molebridge@sha256:cdf5345b0781c50939c8a2634055c6935061c38a9c40ccaf22673ab931599f84

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:cdf5345b0781c50939c8a2634055c6935061c38a9c40ccaf22673ab931599f84 --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest 728b7932f32b932feb1daf51d9a635ee94062b20 \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:988672efc7c4afc1467951fe874e7bbd97cd8ab737fc5abd9a6a8894c9873c48 sha256:225c9f90d66729c67c4fd87bad945c2788e7deb3f3cb97966cbe673420080d4e; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.1 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  5. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:988672efc7c4afc1467951fe874e7bbd97cd8ab737fc5abd9a6a8894c9873c48, linux/arm64 sha256:225c9f90d66729c67c4fd87bad945c2788e7deb3f3cb97966cbe673420080d4e.

Loading

v0.9.0

v0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 09:55
v0.9.0
bf8c5fc

Molebridge v0.9.0, promoted without rebuilding from candidate v0.9.0-rc.2, which passed live acceptance (experimental software; see the README).

Source commit: bf8c5fc9df3988e3b29906ada8f3013730092558
Image index: ghcr.io/irashack/molebridge:v0.9.0@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048
Bundle: molebridge-v0.9.0.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 the image index and each architecture's manifest
Live-acceptance attestation https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 molebridge-v0.9.0.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: bf8c5fc9df3988e3b29906ada8f3013730092558.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.0.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.0.tar.gz
gh attestation verify molebridge-v0.9.0.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.0.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha bf8c5fc9df3988e3b29906ada8f3013730092558 \
  ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048 --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest bf8c5fc9df3988e3b29906ada8f3013730092558 \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify the live-acceptance attestation, and read its result, commit and coverage:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048 --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
  --format json | jq '.[].verificationResult.statement.predicate'

    result must be passed, commit must be bf8c5fc9df3988e3b29906ada8f3013730092558, and the platforms, providers, kinds and drills must be the ones you need.

  5. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:2c43e2d96b7a0dd3178f69c090d6c767cac3d158c019d8a18d03d31331454420 sha256:8e6f6cfe5576e0a1ac6d9e35adcc808dcdd5330bd93d809349fce9e75304c401; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  6. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:2c43e2d96b7a0dd3178f69c090d6c767cac3d158c019d8a18d03d31331454420, linux/arm64 sha256:8e6f6cfe5576e0a1ac6d9e35adcc808dcdd5330bd93d809349fce9e75304c401.

Loading

v0.9.0-rc.2 (release candidate)

v0.9.0-rc.2 (release candidate) Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 04:15
v0.9.0-rc.2
bf8c5fc

Release candidate v0.9.0-rc.2. It has not passed live acceptance; do not install it on an exit you rely on.

Source commit: bf8c5fc9df3988e3b29906ada8f3013730092558
Image index: ghcr.io/irashack/molebridge:v0.9.0-rc.2@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048
Bundle: molebridge-v0.9.0-rc.2.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 the image index and each architecture's manifest
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 molebridge-v0.9.0-rc.2.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: bf8c5fc9df3988e3b29906ada8f3013730092558.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.0-rc.2.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.0-rc.2.tar.gz
gh attestation verify molebridge-v0.9.0-rc.2.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.0-rc.2.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha bf8c5fc9df3988e3b29906ada8f3013730092558 \
  ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048 --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest bf8c5fc9df3988e3b29906ada8f3013730092558 \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:2c43e2d96b7a0dd3178f69c090d6c767cac3d158c019d8a18d03d31331454420 sha256:8e6f6cfe5576e0a1ac6d9e35adcc808dcdd5330bd93d809349fce9e75304c401; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  5. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:2c43e2d96b7a0dd3178f69c090d6c767cac3d158c019d8a18d03d31331454420, linux/arm64 sha256:8e6f6cfe5576e0a1ac6d9e35adcc808dcdd5330bd93d809349fce9e75304c401.

Loading

v0.9.0-rc.1 (release candidate)

v0.9.0-rc.1 (release candidate) Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 01:29
v0.9.0-rc.1
ab031d7

Release candidate v0.9.0-rc.1. It has not passed live acceptance; do not install it on an exit you rely on.

Source commit: ab031d7322d818a7253f9e71a8293011eea026eb
Image index: ghcr.io/irashack/molebridge:v0.9.0-rc.1@sha256:850c1ddde82155e164b24af89f691de859c1c0805126ec2b70fcac0dfea561ed
Bundle: molebridge-v0.9.0-rc.1.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 the image index and each architecture's manifest
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 molebridge-v0.9.0-rc.1.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: ab031d7322d818a7253f9e71a8293011eea026eb.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.9.0-rc.1.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.9.0-rc.1.tar.gz
gh attestation verify molebridge-v0.9.0-rc.1.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.9.0-rc.1.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha ab031d7322d818a7253f9e71a8293011eea026eb \
  ghcr.io/irashack/molebridge@sha256:850c1ddde82155e164b24af89f691de859c1c0805126ec2b70fcac0dfea561ed

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:850c1ddde82155e164b24af89f691de859c1c0805126ec2b70fcac0dfea561ed --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest ab031d7322d818a7253f9e71a8293011eea026eb \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:be17328791b2888316d5a52ae7855cb46fc7e7bd0acb51ade5caf65d1b0575b4 sha256:9811b1faad0a289531926dd8d919d581c365fd3c2197d7e413719817e0b4e1a5; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.1 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  5. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:be17328791b2888316d5a52ae7855cb46fc7e7bd0acb51ade5caf65d1b0575b4, linux/arm64 sha256:9811b1faad0a289531926dd8d919d581c365fd3c2197d7e413719817e0b4e1a5.

Loading

v0.8.0

v0.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 05:17
v0.8.0
ea43d5d

Molebridge v0.8.0, promoted without rebuilding from candidate v0.8.0-rc.2, which passed live acceptance (experimental software; see the README).

What changed: one Go binary and one signed image replace the Python and shell; a native exit is two containers (exit with NetBird inside, and Switchyard); no Python on the host; event-driven routing repair; idle CPU about 0.3 to 0.5 % of one core per exit (7.9 % at 0.7.0). Tested live on rootless Podman with Quadlet only; Docker Engine and NetBird Cloud were not tested. Full entry: CHANGELOG; upgrade from 0.7.x: operations.

Source commit: ea43d5db79bee26e35b42649bed911219bf23a87
Image index: ghcr.io/irashack/molebridge:v0.8.0@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a
Bundle: molebridge-v0.8.0.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material Signed by (workflow identity) Subject
Build provenance (SLSA) and SBOMs https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0-rc.2 the image index and each architecture's manifest
Live-acceptance attestation https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 the image index
Bundle signature and provenance https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 molebridge-v0.8.0.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: ea43d5db79bee26e35b42649bed911219bf23a87.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

  1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

    cosign verify-blob \
  --bundle molebridge-v0.8.0.tar.gz.sigstore.json \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  molebridge-v0.8.0.tar.gz
gh attestation verify molebridge-v0.8.0.tar.gz --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com
tar -xzf molebridge-v0.8.0.tar.gz

  2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

    cosign verify \
  --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository irashack/molebridge \
  --certificate-github-workflow-sha ea43d5db79bee26e35b42649bed911219bf23a87 \
  ghcr.io/irashack/molebridge@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a

  3. Verify the build provenance names this commit and the build workflow:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0-rc.2 \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --source-digest ea43d5db79bee26e35b42649bed911219bf23a87 \
  --predicate-type https://slsa.dev/provenance/v1

  4. Verify the live-acceptance attestation, and read its result, commit and coverage:

    gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a --repo irashack/molebridge \
  --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
  --cert-oidc-issuer https://token.actions.githubusercontent.com \
  --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
  --format json | jq '.[].verificationResult.statement.predicate'

    result must be passed, commit must be ea43d5db79bee26e35b42649bed911219bf23a87, and the platforms, providers, kinds and drills must be the ones you need.

  5. Verify each architecture's SBOM attestation (the manifests the signed index references):

    for manifest in sha256:893ffaeb3f25c4949bd39354ef28afeb35f67ba20a740ee542509b2964587a9d sha256:0b46b1359cff6453ec6ddc34a17b0316c009726c7a15ae98f0488a7a829e45e2; do
  gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
    --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0-rc.2 \
    --cert-oidc-issuer https://token.actions.githubusercontent.com \
    --predicate-type https://spdx.dev/Document/v2.3
done

    The SBOM documents are also attached to this release.

  6. Start the exit with the verified files only: edit .env from .env.example (or .env.sidecar.example), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:893ffaeb3f25c4949bd39354ef28afeb35f67ba20a740ee542509b2964587a9d, linux/arm64 sha256:0b46b1359cff6453ec6ddc34a17b0316c009726c7a15ae98f0488a7a829e45e2.

Loading