v0.8.0

Molebridge v0.8.0, promoted without rebuilding from candidate v0.8.0-rc.2, which passed live acceptance (experimental software; see the README).

What changed: one Go binary and one signed image replace the Python and shell; a native exit is two containers (exit with NetBird inside, and Switchyard); no Python on the host; event-driven routing repair; idle CPU about 0.3 to 0.5 % of one core per exit (7.9 % at 0.7.0). Tested live on rootless Podman with Quadlet only; Docker Engine and NetBird Cloud were not tested. Full entry: CHANGELOG; upgrade from 0.7.x: operations.

Source commit: ea43d5db79bee26e35b42649bed911219bf23a87
Image index: ghcr.io/irashack/molebridge:v0.8.0@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a
Bundle: molebridge-v0.8.0.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material	Signed by (workflow identity)	Subject
Build provenance (SLSA) and SBOMs	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0-rc.2	the image index and each architecture's manifest
Live-acceptance attestation	https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main	the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0	the image index
Bundle signature and provenance	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0	molebridge-v0.8.0.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: ea43d5db79bee26e35b42649bed911219bf23a87.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

   cosign verify-blob \
     --bundle molebridge-v0.8.0.tar.gz.sigstore.json \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     molebridge-v0.8.0.tar.gz
   gh attestation verify molebridge-v0.8.0.tar.gz --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com
   tar -xzf molebridge-v0.8.0.tar.gz

2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

   cosign verify \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-github-workflow-repository irashack/molebridge \
     --certificate-github-workflow-sha ea43d5db79bee26e35b42649bed911219bf23a87 \
     ghcr.io/irashack/molebridge@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a

3. Verify the build provenance names this commit and the build workflow:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0-rc.2 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --source-digest ea43d5db79bee26e35b42649bed911219bf23a87 \
     --predicate-type https://slsa.dev/provenance/v1

4. Verify the live-acceptance attestation, and read its result, commit and coverage:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:aa882618115e602c554901a9b5e7d504068499da6da0ff921bf40cd39767e52a --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
     --format json | jq '.[].verificationResult.statement.predicate'

   result must be passed, commit must be ea43d5db79bee26e35b42649bed911219bf23a87, and the platforms, providers, kinds and drills must be the ones you need.

5. Verify each architecture's SBOM attestation (the manifests the signed index references):

   for manifest in sha256:893ffaeb3f25c4949bd39354ef28afeb35f67ba20a740ee542509b2964587a9d sha256:0b46b1359cff6453ec6ddc34a17b0316c009726c7a15ae98f0488a7a829e45e2; do
     gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
       --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.8.0-rc.2 \
       --cert-oidc-issuer https://token.actions.githubusercontent.com \
       --predicate-type https://spdx.dev/Document/v2.3
   done

   The SBOM documents are also attached to this release.

6. Start the exit with the verified files only: edit .env from .env.example (or .env.sidecar.example), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:893ffaeb3f25c4949bd39354ef28afeb35f67ba20a740ee542509b2964587a9d, linux/arm64 sha256:0b46b1359cff6453ec6ddc34a17b0316c009726c7a15ae98f0488a7a829e45e2.