Tools
Docker cagent's `share push --key` now signs a DSSE-wrapped in-toto statement instead of raw YAML bytes
Release 1.138.1 on 2026-09-11 changes agent-artifact signing so the signature covers an in-toto statement carrying metadata about where and when the artifact was published, rather than just the YAML payload. The same release adds `kubectl` and the AWS CLI to the `sbx-templates` sandbox image, adds secure HTTP relay packages for agent configuration fetching and model-API forwarding, and fixes a production data race where `ReplaceSession` wrote `a.session` while background goroutines read it.
Source
↳ Follow the thread