Skip to content

v2.3.1
Compare
Choose a tag to compare
@github-actions github-actions released this 08 Mar 00:32
· 805 commits to main since this release
v2.3.1
This tag was signed with the committer’s verified signature.
adamreese Adam Reese
GPG key ID: 06F35E60A7A18DD6
Learn about vigilant mode.
22c2ac5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

Spin 2.3.1

This is a patch release of Spin to enable fuller functionality in the Spin containerd shim.

Changes

  • #2322 updates the OCI crate to set the digest of the locked Spin application in the OCI image config to ensure that image config digests are updated when Spin apps are updated. This resolves an issue with the Spin containerd shim serving outdated content due to the image config digest not updating.
  • #2318 add support for loading precompiled Spin applications. This can provide performance improvements for users of the crate, such as the Spin containerd shim.

Verifying the Release Signature 🔏

After downloading the v2.3.1 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.3.1 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Full Changelog: v2.3.0...v2.3.1

Assets 10