v0.15.6

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.6      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.6
docker pull ghcr.io/openctemio/openctem-web:v0.15.6
docker pull ghcr.io/openctemio/openctem-console:v0.15.6   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.6
docker pull ghcr.io/openctemio/seed:v0.15.6
docker pull ghcr.io/openctemio/admin-cli:v0.15.6

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.6 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.6 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.6 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.6.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.6-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.6 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• release: v0.15.6 by @0xmanhnv in #3272

Full Changelog: v0.15.5...v0.15.6