v0.9.1

Molebridge v0.9.1, promoted without rebuilding from candidate v0.9.1-rc.3, which passed live acceptance (experimental software; see the README).

Source commit: df163f24ae4b4cb4dac310dbed770baf004b68d2
Image index: ghcr.io/irashack/molebridge:v0.9.1@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a
Bundle: molebridge-v0.9.1.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material	Signed by (workflow identity)	Subject
Build provenance (SLSA) and SBOMs	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3	the image index and each architecture's manifest
Live-acceptance attestation	https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main	the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1	the image index
Bundle signature and provenance	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1	molebridge-v0.9.1.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: df163f24ae4b4cb4dac310dbed770baf004b68d2.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

   cosign verify-blob \
     --bundle molebridge-v0.9.1.tar.gz.sigstore.json \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     molebridge-v0.9.1.tar.gz
   gh attestation verify molebridge-v0.9.1.tar.gz --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com
   tar -xzf molebridge-v0.9.1.tar.gz

2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

   cosign verify \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-github-workflow-repository irashack/molebridge \
     --certificate-github-workflow-sha df163f24ae4b4cb4dac310dbed770baf004b68d2 \
     ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a

3. Verify the build provenance names this commit and the build workflow:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --source-digest df163f24ae4b4cb4dac310dbed770baf004b68d2 \
     --predicate-type https://slsa.dev/provenance/v1

4. Verify the live-acceptance attestation, and read its result, commit and coverage:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:873e6bb96c5b2721d84d56cb167507a0a5c9cdca56ce0f5b392f2e5f55e6a78a --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
     --format json | jq '.[].verificationResult.statement.predicate'

   result must be passed, commit must be df163f24ae4b4cb4dac310dbed770baf004b68d2, and the platforms, providers, kinds and drills must be the ones you need.

5. Verify each architecture's SBOM attestation (the manifests the signed index references):

   for manifest in sha256:6028e0d37ccaa1e8d181b59b8febd564605032cd557e4e225cebd1f521513c20 sha256:76d773f21e7dd7ae39fb9d693e1afc1dbd6f6f2aff73ad14a8bf5a6386b6298a; do
     gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
       --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.1-rc.3 \
       --cert-oidc-issuer https://token.actions.githubusercontent.com \
       --predicate-type https://spdx.dev/Document/v2.3
   done

   The SBOM documents are also attached to this release.

6. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:6028e0d37ccaa1e8d181b59b8febd564605032cd557e4e225cebd1f521513c20, linux/arm64 sha256:76d773f21e7dd7ae39fb9d693e1afc1dbd6f6f2aff73ad14a8bf5a6386b6298a.