Skip to content

Signing & SBOM

Latest
Latest

Choose a tag to compare

View all tags
@mananqayas mananqayas released this 26 Oct 03:20
· 2 commits to main since this release
v4.0.0
25091d6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[4.0.0] - 2026-10-22

Added

  • Docker build and push: Added CI steps for docker build and push to GHCR
  • SBOM production: Generating CycloneDX SBOMs for OS libraries and runtime packages
  • Cosign image sign and SBOM attestation: Signed image artifact and SBOMs using cosign keyless public infra
  • Verification: Image signature and SBOM attestation are verified with our own certificate identity and image digest claims
Assets 2
Loading