Obol Free Self-hosted 0.1.0

Obol Free Self-hosted 0.1.0, built from revision 74c14c2189be4b123f7a5bd43a5f1a0c787c1522.

Images (linux/amd64, linux/arm64), pinned by digest:

• control: ghcr.io/tryobol/control@sha256:39bf364c246013d6e7b5436f44a010eaf9ba3eb3041377c94712c06141ecb211
• gateway: ghcr.io/tryobol/gateway@sha256:d01b293c554de0827deafcdc2a635c4b615cf2a4135dc3a8dec55574f0974eb9
• web: ghcr.io/tryobol/web@sha256:1195fd1a7f8144971f229dbd97b674aa154e4bc029474c87aec63d66eafb0c77

Upgrade floor: none declared.

Verify before installing:

sha256sum -c obol-selfhost-0.1.0.tar.gz.sha256
docker buildx imagetools inspect <image>@sha256:... --format '{{json .SBOM}}'

Publisher signature: verify RELEASE_SHA256SUMS.sigstore.json with Cosign
against RELEASE_SHA256SUMS, then check the downloaded assets against it.
The signed release.json pins every image digest. This authenticates
the publisher and release bytes; it is not private-build provenance.

cosign verify-blob --bundle RELEASE_SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/tryobol/obol-releases/.github/workflows/sign-release.yml@refs/heads/main' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com RELEASE_SHA256SUMS
sha256sum --ignore-missing -c RELEASE_SHA256SUMS

Release CI started these digests on disposable amd64 and arm64 runners.
That is CI evidence, not a support commitment: Free Self-hosted is
customer-operated, single-host Compose, with no SLA, HA or air-gap promise.