Releases

You can find the most recent version in the GitHub Releases.

Versioning

Versions are expressed as x.y.z, where x is the major version, y is the minor version, and z is the patch version, following Semantic Versioning terminology.

Verifying release artefacts

Every release artefact (each binary and checksums.txt) is keylessly signed with cosign during the release workflow. For each artefact <file>, a matching Sigstore bundle <file>.sigstore.json (containing the signature, certificate, and transparency-log proof) is published next to it on the GitHub Release page.

To verify a downloaded binary, install cosign and run cosign verify-blob, pointing it at the artefact's .sigstore.json bundle:

cosign verify-blob \
  --bundle arc-apiserver-linux-amd64.sigstore.json \
  --certificate-identity-regexp 'https://github.com/opendefensecloud/artifact-conduit/\.github/workflows/release\.yaml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  arc-apiserver-linux-amd64

The same command works for checksums.txt and any other artefact — swap the file names accordingly. A successful run prints Verified OK.

Release binaries additionally carry a build-provenance attestation, which can be verified with the GitHub CLI:

gh attestation verify arc-apiserver-linux-amd64 --repo opendefensecloud/artifact-conduit