v4.2.0

Verifying the Release Signature

After downloading the v4.2.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then, from the directory containing the extracted release archive (spin, spin.sig and crt.pem), run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/spinframework/spin/.github/workflows/release.yml@refs/tags/v4.2.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha f3881ad20072ddaae1b377b4ca13d499eb3ccf83 \
    --certificate-github-workflow-repository spinframework/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• Push trigger dependencies when composition is disabled by @ChihweiLHBird in #3686
• Bump version for next aniticipated release by @fibonacci1729 in #3688
• Fix GitHub release creation failing when auto-generated notes exceed 125k chars by @fibonacci1729 with @Copilot in #3690
• chore(rust-sdk-release): bump Spin Rust SDK to v7.0.0 by @spinframeworkbot in #3689
• Break the v2 manifest across modules by @itowlson in #3692
• Update manifest JSON schema with HTTP static_response by @itowlson in #3695
• Miscellaneous performance optimizations by @ChihweiLHBird in #3624
• Middleware composition re-use by @fibonacci1729 in #3700
• Break WASIp3 HTTP server ownership cycle by @carsonfarmer in #3704
• Count TCP sockets from creation by @carsonfarmer in #3707
• add Zhiwei as maintainer by @michelleN in #3701
• Deny named imports by @fibonacci1729 in #3711
• Update wasm-tools/wit-bindgen dependencies by @alexcrichton in #3712
• outbound-networking: Memoize default TlsClientConfig by @lann in #3714
• Avoid reinstalling env templates if Git source has not changed by @itowlson in #3676
• Fix WIT extractor emitting wrong interface when duplicated name by @itowlson in #3716
• Add schema directive to empty template by @itowlson in #3717
• Reduce string allocations by @lann in #3718
• Parameterize Azure Cosmos key-value queries by @ChihweiLHBird in #3720
• Bump Wasmtime to v49.0.0 prerelease by @spinframeworkbot in #3710
• Spin deps CLI by @fibonacci1729 in #3660
• Match inherited capability imports by semver track by @ChihweiLHBird in #3722
• Build the deny adapter without WASI std by @fibonacci1729 in #3723
• ci: Fix release job when canary release is missing by @lann in #3725
• Upgrade wasmtime to 49.0.1 by @lann in #3726
• Add impl for wasi:keyvalue/{atomics,batch} in deny-all-adapter by @karthik2804 in #3724
• Add OpenBao Variable Provider by @thorstenhans in #3719
• Reuse UTF-8 buffers when rendering templates by @ChihweiLHBird in #3727

New Contributors

• @fibonacci1729 with @Copilot made their first contribution in #3690

Full Changelog: v4.1.0...v4.2.0