2.6.1

2 commits, 1 contributor, 2 hours since 2.6.0.

Bug fixes

• ci: sign every binary cell in one job (b27e9d1)
• build: fetch public Go modules through proxy.golang.org (d54fe18)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:2.6.1

This release also publishes the 2.6 and 2 tags — pull the precision you want to pin.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Image digests

A tag can move; a digest cannot. Pull this exact build:

docker pull ghcr.io/projectfile-org/ci@sha256:06a98c4c0665e77bdb778f2ba6c32f3cd0f4811dfcdc6dd75dea185ad9925059

Platform	Digest	Size
linux/amd64	sha256:17024c811208566550b6ed3fe9233f146e63972f34abf753c9c1b8b352824633	87.3 MB
linux/arm64	sha256:94e807ba1ea958370dfc586c8a1e898a4750f970b0004784c959db3b176d00b1	84.0 MB
linux/riscv64	sha256:eff2549582da7a933d327161d55fb84570203b1350cd073603a6aa18ab476588	88.2 MB

Sizes are compressed layer bytes as stored in the registry.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci@sha256:06a98c4c0665e77bdb778f2ba6c32f3cd0f4811dfcdc6dd75dea185ad9925059
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci@sha256:06a98c4c0665e77bdb778f2ba6c32f3cd0f4811dfcdc6dd75dea185ad9925059

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc pf-ci

Full changes: 2.6.0...2.6.1