Pullbox v1.0.4

What's Changed

Maintenance release focused on reliable multi-platform publication across
Docker runtimes with classic image stores.

CI / Build

• Evicted the digest-selected image between AMD64 and ARM64 runtime checks so
  sequential verification cannot fail with Docker's cannot overwrite digest
  error after manifests are published.

Commit Details

🧰 Chores

• bump version to 1.0.4 for release
• sync develop after v1.0.3 release

🐳 Docker Images

docker pull ghcr.io/pullboxapp/pullbox:1.0.4
docker pull docker.io/pullbox/pullbox:1.0.4

Digest: sha256:6ddc2b70a71896d2ecea8bdaa879db546d507cdba804633ad8141c840424d6c6

🔐 Image Verification

Release images are signed with keyless Sigstore/Cosign using GitHub Actions OIDC.
These commands verify the exact multi-architecture image digest published by this release.

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.4$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/pullboxapp/pullbox@sha256:6ddc2b70a71896d2ecea8bdaa879db546d507cdba804633ad8141c840424d6c6

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.4$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  docker.io/pullbox/pullbox@sha256:6ddc2b70a71896d2ecea8bdaa879db546d507cdba804633ad8141c840424d6c6

Full Changelog: v1.0.3...v1.0.4