agent-gm v1.4.1

agent-gm v1.4.1

Source commit: 0c99334bd8e5dd348a70b9efce84b0ab1d4bb2a8

Container image

Deployments pin by digest, not by tag:

ghcr.io/thisnick/agent-gm@sha256:c10fefe590cd1875dfdb9cf1d60802884d9513eae16047d0818245497fd25c11

Tags v1.4.1, v1.4 and latest point at that digest today.
They are labels; the digest is the evidence.

Pins

Dependency	Pin
go.mau.fi/mautrix-gmessages (libgm)	caaeaa7d8d56b828c225cb1f1ad2d15c8a3f1d0d
github.com/modelcontextprotocol/go-sdk	v1.7.0

Artefacts

checksums.txt is signed with cosign keyless over GitHub OIDC. Verify with:

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/thisnick/agent-gm/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The npm wrapper @agent-gm/cli@1.4.1 downloads the agm archive for
your platform from this release and verifies it against a copy of
checksums.txt pinned inside the npm tarball.

Agent GM is AGPL-3.0-or-later. The corresponding source for these binaries is
this repository at 0c99334bd8e5dd348a70b9efce84b0ab1d4bb2a8.