v0.9.2

Molebridge v0.9.2, promoted without rebuilding from candidate v0.9.2-rc.1, which passed live acceptance (experimental software; see the README).

Source commit: cd605622cf73586f9a391d6689b9dae2087bc04d
Image index: ghcr.io/irashack/molebridge:v0.9.2@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b
Bundle: molebridge-v0.9.2.tar.gz (Compose files with the image pinned to that reference, the .env examples, routing/gluetun-preflight, license notices)

What to trust

Material	Signed by (workflow identity)	Subject
Build provenance (SLSA) and SBOMs	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1	the image index and each architecture's manifest
Live-acceptance attestation	https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main	the image index; predicate type https://github.com/irashack/molebridge/attestations/live-acceptance/v1
Image index signature	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2	the image index
Bundle signature and provenance	https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2	molebridge-v0.9.2.tar.gz

OIDC issuer for every signature: https://token.actions.githubusercontent.com. Expected source commit: cd605622cf73586f9a391d6689b9dae2087bc04d.
Tools: cosign v3.1.3, the GitHub CLI (gh) 2.102.0 or later, jq.

Verify, in this order

1. Download the bundle and its Sigstore bundle (certificate and transparency-log entry) from this release's assets, then verify the bundle archive before extracting it:

   cosign verify-blob \
     --bundle molebridge-v0.9.2.tar.gz.sigstore.json \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     molebridge-v0.9.2.tar.gz
   gh attestation verify molebridge-v0.9.2.tar.gz --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com
   tar -xzf molebridge-v0.9.2.tar.gz

2. Verify the image index signature, bound to the repository, the workflow identity, the issuer and the source commit. The image to verify is the pinned reference in the extracted compose.yaml:

   cosign verify \
     --certificate-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2 \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-github-workflow-repository irashack/molebridge \
     --certificate-github-workflow-sha cd605622cf73586f9a391d6689b9dae2087bc04d \
     ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b

3. Verify the build provenance names this commit and the build workflow:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --source-digest cd605622cf73586f9a391d6689b9dae2087bc04d \
     --predicate-type https://slsa.dev/provenance/v1

4. Verify the live-acceptance attestation, and read its result, commit and coverage:

   gh attestation verify oci://ghcr.io/irashack/molebridge@sha256:f91787689be0600ce2de248b6c6f329872cd66d3dd8c1e090b38abb12b29d98b --repo irashack/molebridge \
     --cert-identity https://github.com/irashack/molebridge/.github/workflows/acceptance.yml@refs/heads/main \
     --cert-oidc-issuer https://token.actions.githubusercontent.com \
     --predicate-type https://github.com/irashack/molebridge/attestations/live-acceptance/v1 \
     --format json | jq '.[].verificationResult.statement.predicate'

   result must be passed, commit must be cd605622cf73586f9a391d6689b9dae2087bc04d, and the platforms, providers, kinds and drills must be the ones you need.

5. Verify each architecture's SBOM attestation (the manifests the signed index references):

   for manifest in sha256:fcb991b7c7154db29065c1b552c0b5753f396704bb4ae9f4613a1f02078ea67b sha256:4d82cf1797556cb7ae3a7db1d59be117543354bb7fb0fe3aa354e5ebee376c10; do
     gh attestation verify oci://ghcr.io/irashack/molebridge@$manifest --repo irashack/molebridge \
       --cert-identity https://github.com/irashack/molebridge/.github/workflows/release.yml@refs/tags/v0.9.2-rc.1 \
       --cert-oidc-issuer https://token.actions.githubusercontent.com \
       --predicate-type https://spdx.dev/Document/v2.3
   done

   The SBOM documents are also attached to this release.

6. Start the exit with the verified files only: edit .env from .env.example (or .env.gluetun.example, .env.sidecar.example or .env.native-sidecar.example, each of which selects its own Compose file), then docker compose up -d. The Compose files reference the image by digest, so the image that runs is the one verified above.

Architecture manifests: linux/amd64 sha256:fcb991b7c7154db29065c1b552c0b5753f396704bb4ae9f4613a1f02078ea67b, linux/arm64 sha256:4d82cf1797556cb7ae3a7db1d59be117543354bb7fb0fe3aa354e5ebee376c10.