Skip to content

Conversation

@rancherbot
Copy link

v3.3.0 (v3.3.0)

Verifying the Release Signature

After downloading the v3.3.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/spinframework/spin/.github/workflows/release.yml@refs/tags/v3.3.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha 9dadd8c4bf347e5703f9488a7ec7eb4239cd083c \
    --certificate-github-workflow-repository spinframework/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

Full Changelog: spinframework/spin@v3.2.0...v3.3.0
Compare between v3.2.0 and v3.3.0

Signed-off-by: Rancher Desktop Dependency Manager <[email protected]>
@jandubois jandubois merged commit fec295c into main Jun 12, 2025
20 checks passed
@jandubois jandubois deleted the rddepman/spinCLI/3.2.0-to-3.3.0 branch June 12, 2025 22:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants