This is the public release repository for the Stackweaver API. It is published from the Stackweaver source tree on every release. See the release sync architecture for how releases are built, signed, and mirrored here.
docker pull ghcr.io/vhco-pro/stackweaver-api:latestSee the Stackweaver documentation for deployment instructions.
Every image published by this satellite is Sigstore-signed (keyless, via Fulcio + Rekor) and ships with build-provenance and SBOM attestations. To verify a specific tag:
cosign verify \
--certificate-identity-regexp "^https://github\.com/vhco-pro/stackweaver-api/\.github/workflows/release\.yml@refs/tags/.+$" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
ghcr.io/vhco-pro/stackweaver-api:<tag>The full verification guide including SBOM extraction, SLSA provenance (live after the Wave-6 visibility flip), and gitsign verify for sync commits lives at https://sw.vhco.pro/docs/security/verifying-releases.
Stackweaver™ is a trademark of VH & Co. The Stackweaver name and word mark identify the official Stackweaver project; the source-code licence does not grant a right to use the mark in product names, hosted services, or company names. See the Trademark Policy for the full terms.
Business Source License 1.1 — see LICENSE for details.