v0.9.0

Molebridge v0.9.0, promoted without rebuilding from candidate v0.9.0-rc.2, which passed live acceptance (experimental software; see the README).

Source commit: bf8c5fc9df3988e3b29906ada8f3013730092558
Image index: ghcr.io/irashack/molebridge:v0.9.0@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048
Bundle: molebridge-v0.9.0.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material	Signed by (workflow identity)	Subject
Build provenance (SLSA) and SBOMs	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2	the image index and each architecture's manifest
Live-acceptance attestation	https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main	the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0	the image index
Bundle signature and provenance	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0	molebridge-v0.9.0.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: bf8c5fc9df3988e3b29906ada8f3013730092558.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

   cosign verify-blob \
     --bundle molebridge-v0.9.0.tar.gz.sigstore.json \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     molebridge-v0.9.0.tar.gz
   gh attestation verify molebridge-v0.9.0.tar.gz --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com
   tar -xzf molebridge-v0.9.0.tar.gz

2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

   cosign verify \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-github-workflow-repository irashack/molebridge \
     --certificate-github-workflow-sha bf8c5fc9df3988e3b29906ada8f3013730092558 \
     ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048

3. Verify the build provenance names this commit and the build workflow:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048 --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --source-digest bf8c5fc9df3988e3b29906ada8f3013730092558 \
     --predicate-type https://slsa.dev/provenance/v1

4. Verify the live-acceptance attestation, and read its result, commit and coverage:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:812801af2fae2df9f185475ad84197ebcd914ddf9a1826f5851eae142e610048 --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
     --format json | jq '.[].verificationResult.statement.predicate'

   result must be passed, commit must be bf8c5fc9df3988e3b29906ada8f3013730092558, and the platforms, providers, kinds and drills must be the ones you need.

5. Verify each architecture's SBOM attestation (the manifests the signed index references):

   for manifest in sha256:2c43e2d96b7a0dd3178f69c090d6c767cac3d158c019d8a18d03d31331454420 sha256:8e6f6cfe5576e0a1ac6d9e35adcc808dcdd5330bd93d809349fce9e75304c401; do
     gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
       --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.0-rc.2 \
       --cert-oidc-issuer https://token.actions.githubusercontent.com \
       --predicate-type https://spdx.dev/Document/v2.3
   done

   The SBOM documents are also attached to this release.

6. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:2c43e2d96b7a0dd3178f69c090d6c767cac3d158c019d8a18d03d31331454420, linux/arm64 sha256:8e6f6cfe5576e0a1ac6d9e35adcc808dcdd5330bd93d809349fce9e75304c401.