Verify Docker Image Signature
All LiteLLM Docker images are signed with cosign. This release is signed with the key introduced in commit e82a3c6.
Verify using the pinned commit hash (recommended):
A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the published signing key:
cosign verify \
--key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
ghcr.io/berriai/litellm:v1.108.4Verify using the release tag (convenience):
Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
cosign verify \
--key https://raw.githubusercontent.com/BerriAI/litellm/v1.108.4/cosign.pub \
ghcr.io/berriai/litellm:v1.108.4Expected output:
The following checks were performed on each of these signatures:
- The cosign claims were validated
- The signatures were verified against the specified public key
What's Changed
- fix(videos): backport #48490 and #44614 to lts/1.108.x by @kerry-berri in #50693
- fix(sdk): backport #45961 to lts/1.108.x by @krrish-berri-2 in #50605
- fix(bedrock)!: backport #47429 pass-through guardrailConfig and the integration test fixes to lts/1.108.x by @yuneng-berri in #50568
- fix(anthropic): backport #49076 encrypted reasoning round-trip to lts/1.108.x by @mateo-berri in #50456
- fix(vertex_ai): backport Claude batches in Anthropic's row shape to lts/1.108.x (#45715) by @mateo-berri in #50365
- fix(bedrock): backport #50073 to lts/1.108.x by @mateo-berri in #50399
- fix(anthropic): backport background rejection on the /v1/messages Responses bridge to lts/1.108.x by @mateo-berri in #50462
- chore: bump litellm to 1.108.4 on lts/1.108.x by @yuneng-berri in #50729
Full Changelog: v1.108.3...v1.108.4