Verifying the Release Signature

After downloading the v4.0.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/spinframework/spin/.github/workflows/release.yml@refs/tags/v4.0.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha 5f3aa19c50d1609592f7ea2f6362209a04da52ac \
    --certificate-github-workflow-repository spinframework/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• Bump version for next release by @fibonacci1729 in #3393
• Use wasm32-wasip2 in Rust templates by @itowlson in #3396
• Spin 3.6 target environment definition by @itowlson in #3394
• Fix a wasm32-wasip2 woe that only turned up after landing in main by @itowlson in #3399
• Make reuse trigger cli args public by @fibonacci1729 in #3402
• Make OCI component resolver available to SpinKube by @itowlson in #3403
• feat: proposal to add the fermyon/otel-plugin to the spinframework org by @asteurer in #3408
• outbound-http: Fix spin interface DNS resolution by @lann in #3409
• Postgres fallback port resolution fix by @itowlson in #3398
• update to Wasmtime 41.0.4 by @dicej in #3410
• feat(cli/debug): add --debug-info flag by @radu-matei in #3412
• Limit result sizes across factors by @fibonacci1729 in #3411
• Fix a future incompatibility warning about never fallback by @itowlson in #3418
• Postgres custom root certificates by @itowlson in #3395
• Update to Wasmtime 42.0.1 by @alexcrichton in #3419
• Build profiles by @itowlson in #3246
• Rev package to 3.7.0 by @itowlson in #3420
• Access KV StoreManager metadata by @kate-goldenring in #3424
• Async PostgreSQL API by @itowlson in #3404
• Key-value and SQLite async by @itowlson in #3423
• Spin Improvement Proposal: Supporting multiple build profiles by @tschneidereit in #3075
• Use system certificates via rustls-platform-verifier by @rajsite in #3426
• Use type-safe default values for clap ListFormat enums by @ChihweiLHBird in #3430
• Wasmtime 43 by @itowlson in #3427
• Extract dependency WITs during build by @itowlson in #3378
• fix(tracing/outbound-redis): skip Redis arguments in traces by @radu-matei in #3432
• More async interfaces by @itowlson in #3428
• spin deploy: no plugin specified is now hard error by @itowlson in #3397
• Clap 3 → Clap 4 Upgrade by @fibonacci1729 in #3431
• Add --format json option for HTTP trigger route output by @ChihweiLHBird in #3429
• Async Redis trigger by @itowlson in #3435
• Switch WIT package to 4.0.0, and rev CLI by @itowlson in #3436
• feat(otel/logs): pipe emitting component through otel logs by @radu-matei in #3434
• No spin-dependencies.wit file if no dependencies by @itowlson in #3440
• Don't require DCO from org members by @itowlson in #3441
• minor sqlite-libsql refactor by @dicej in #3443
• remove debug print statement from sqlite-inproc by @dicej in #3447
• Fix WIT extractor ignoring world-level functions by @itowlson in #3446
• add ServiceIndices field to HandlerType::Wasi0_3 by @dicej in #3449
• persist WASIp3 HTTP handler until response body is drained by @dicej in #3454
• Don't log full PostgreSQL connection string by @itowlson in #3461
• When WAGI converts string to HeaderValue, error rather than unwrap by @itowlson in #3464
• SIP-023 Fine-grained Capability Inheritance by @fibonacci1729 in #3445
• Implementation of SIP 023 by @fibonacci1729 in #3450
• nit: replace fermyon w/ spin by @fibonacci1729 in #3466
• Use macro instead of checking bindings in by @fibonacci1729 in #3465
• Update wasm-tools / wit-bindgen / wac dependencies by @fibonacci1729 in #3467
• Add content-length header attributes to outbound HTTP spans by @ChihweiLHBird in #3459
• Fix Markdown reference missing spin up bits by @itowlson in #3468
• Bump versions for v4.0 by @fibonacci1729 in #3469

New Contributors

• @rajsite made their first contribution in #3426
• @ChihweiLHBird made their first contribution in #3430

Full Changelog: v3.6.3...v4.0.0