Releases

Every version we publish, newest first. Each release is one image digest pushed to GHCR, signed twice on that digest, with the chart published alongside it.

How releases are signed

Every release carries two signatures over the same image digest, and they answer different questions.

• Keyless, through GitHub's OIDC: proves this exact digest was built by the release workflow, on this tag, in this repository, and records it in the public transparency log. The stronger claim — check it when you have internet.
• Keyed, against cosign.pub from the repository root: verifies with nothing beyond your registry. This one exists for air-gapped clusters, which cannot reach the transparency log at all.

# keyed — works offline, cosign.pub ships in the repository root and the chart
cosign verify --key cosign.pub ghcr.io/attestkeep/attestkeep-k8s:0.1.0

# both checks together — the same script the release pipeline runs on itself
./scripts/verify-release.sh ghcr.io/attestkeep/attestkeep-k8s:0.1.0 cosign.pub

Always verify the digest, not the tag: a tag can be moved to different content after it was signed, a digest cannot. This is the same argument the product makes to your own cluster in digestEnforcement.

v0.1.0

2026-08-30 — the first published release.

• Admission webhook: image scanning verdicts, severity gates, :latest refusal, digest enforcement, registry allow-lists, workload hardening, break-glass with expiry.
• Scan pipeline: Trivy-backed scanning with a PostgreSQL work queue, cosign signature and attestation checks, rate-limit-aware retry.
• Evidence: signed compliance packages (DSSE, in-toto Statement v1) mapped onto eight frameworks — SOC 2, ISO/IEC 27001:2022, NIST SP 800-53, NIST SP 800-190, SSDF, DORA, EU CRA+NIS2, GDPR Article 32 — verifiable in a browser with nothing installed.
• Console: images, policies, findings, triage, evidence, notifications, licensing.

helm install attestkeep oci://ghcr.io/attestkeep/charts/attestkeep \
  --version 0.1.0 \
  --namespace attestkeep --create-namespace \
  --set clusterName=production-eu \
  --wait

Release notes, the SBOM and cosign.pub are attached to the GitHub release.