Verify Docker Image Signature
All LiteLLM Docker images are signed with cosign. This release is signed with the key introduced in commit e82a3c6.
Verify using the pinned commit hash (recommended):
A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the published signing key:
cosign verify \
--key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
ghcr.io/berriai/litellm:v1.108.2Verify using the release tag (convenience):
Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
cosign verify \
--key https://raw.githubusercontent.com/BerriAI/litellm/v1.108.2/cosign.pub \
ghcr.io/berriai/litellm:v1.108.2Expected output:
The following checks were performed on each of these signatures:
- The cosign claims were validated
- The signatures were verified against the specified public key
What's Changed
- fix(audio-transcription): backport #50137 to lts/1.108.x by @mateo-berri in #50325
- fix(router): backport #48470 to lts/1.108.x by @shrey-berri in #50297
- fix(backport): bring #50132, #50218, #50274 and #50276 onto lts/1.108.x by @kerry-berri in #50326
- fix(bedrock): backport #43086 to lts/1.108.x by @mateo-berri in #50362
- fix(bedrock): backport Converse service_tier fix to lts/1.108.x by @mateo-berri in #50360
- fix(vertex_ai): backport #50255 to lts/1.108.x by @mateo-berri in #50392
- fix(mcp): backport #48931 to lts/1.108.x by @mateo-berri in #50348
- fix(responses): backport json_object system prompt in input to lts/1.108.x (#49957) by @mrinal-berri in #50267
- fix: backport #46870, #46984 and #47100 to lts/1.108.x by @mateo-berri in #50280
Full Changelog: v1.108.1...v1.108.2