v4.3.0

Verifying the Release Signature

After downloading the v4.3.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then, from the directory containing the extracted release archive (spin, spin.sig and crt.pem), run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/spinframework/spin/.github/workflows/release.yml@refs/tags/v4.3.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha 83b512fdf5a11783fde1d8546117b672fe9dd46e \
    --certificate-github-workflow-repository spinframework/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• Bump version for next release by @fibonacci1729 in #3730
• Work around for set-path-with-query failing on empty string by @itowlson in #3731
• Fix typos in doc comments by @GhostCoder6969 in #3736
• Allow TCP and UDP only conditionally by @itowlson in #3735
• Update to Wasmtime 49.0.3 by @itowlson in #3741
• Update wasm-tools dependencies by @alexcrichton in #3744
• refactor: Use Path::join to resolve absolute and relative paths. by @ChihweiLHBird in #3745
• Bump rustls from 0.23.43 to 0.23.45 by @dependabot[bot] in #3742
• Bump rustls from 0.23.43 to 0.23.45 in /examples/spin-timer by @dependabot[bot] in #3747
• Bump Wasmtime to v50.0.0 by @spinframeworkbot in #3738
• Update SECURITY.md with email contact information by @ChihweiLHBird in #3750
• Upgrade webpki dependencies by @itowlson in #3751
• Update to Wasmtime 50.0.1 by @alexcrichton in #3757
• Compose middlewares with semver compatible versions by @fibonacci1729 in #3758
• Split the OCI loader conversion into reusable helpers by @wrkode in #3761
• Move the duplicated Git subprocess helper into spin-common by @ChihweiLHBird in #3763
• outbound-http: Set TCP_NODELAY by default by @lann in #3767
• Improve IP host handling in legacy fermyon:spin/http interface by @lann in #3768
• chore(templates): update to use spin-go-sdk v4 by @adamreese in #3765
• WASI 0.3.2 WITs by @itowlson in #3766
• Add prepared application directories (spin registry pull --prepare, spin up --from-prepared) by @wrkode in #3762

New Contributors

• @GhostCoder6969 made their first contribution in #3736
• @wrkode made their first contribution in #3761

Full Changelog: v4.2.6...v4.3.0