Verify Docker Image Signature
All LiteLLM Docker images are signed with cosign. This release is signed with the key introduced in commit e82a3c6.
Verify using the pinned commit hash (recommended):
A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the published signing key:
cosign verify \
--key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
ghcr.io/berriai/litellm:v1.106.9Verify using the release tag (convenience):
Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
cosign verify \
--key https://raw.githubusercontent.com/BerriAI/litellm/v1.106.9/cosign.pub \
ghcr.io/berriai/litellm:v1.106.9Expected output:
The following checks were performed on each of these signatures:
- The cosign claims were validated
- The signatures were verified against the specified public key
What's Changed
- feat(chatgpt): backport #41522 client subscription forwarding to stable/1.106.x for v1.106.8 by @jesus-berri in #49888
- security(proxy): backport #51254 to stable/1.106.x by @shrey-berri in #51261
- chore(release): bump version to 1.106.9 by @yuneng-berri in #51270
Full Changelog: v1.106.8...v1.106.9