QQeravio
עברית
Canonical AI event

Docker images and Helm charts now signed with new cosign key from commit e82a3c6.

The new cosign key for Docker images and Helm charts is from commit e82a3c6. The eMudhra root CA has been removed from trusted certificate bundles.

24 Oct 20261 verified claims1 sources1 observations
What happened

The official source reports this update: v1.103.8. Important The image-signing key has changed. Starting with this release, every Docker image and Helm chart is signed with the new cosign key from commit e82a3c6 . Verifying with the previous key from commit 0112e53 will fail. Update anything that pins the old cosign.pub : cosign verify scripts, CI checks, and admission policies such as Kyverno, Sigstore policy-controller or Connaisseur.

Why it matters

This official update documents a development concerning v1.103.8. Its practical significance depends on the scope and evidence stated by the source.

What to watch next

Read the official source update and verify its stated scope, evidence and timing before acting on it.

Connected knowledge

Entities affected by this event

Litellmsubject
Continue this topic
infrastructureVersion 1.107.0 of the software now uses a shared helper to join API base and route.21 Oct 2026infrastructureLiteLLM Docker images now require signature verification.21 Oct 2026infrastructureLiteLLM adds breached password detection to password policy.3 Oct 2026infrastructureLiteLLM v1.100.2 adds content policy violation fallback routing.23 Sept 2026infrastructureLiteLLM Docker images now require signature verification.15 Sept 2026infrastructureLiteLLM 1.99.1 Docker images now include OpenTelemetry v2 cache token counts.3 Sept 2026
Evidence trail

Sources behind the event

LiteLLM official releasesv1.103.8
Editorial presentation

Read the public story

Open story