Docker cagent signs agent artifacts with in-toto statements now

Docker's cagent project changed how share push --key signs agent artifacts in version 1.138.1. The signature now covers a DSSE-wrapped in-toto statement that carries metadata about where and when the artifact was published, not just the raw YAML bytes, according to the release notes.

That distinction is the whole point of in-toto. A signature over raw bytes only proves the bytes weren't altered. A signature over a statement proves who published it and when, which matters if you're pulling agent definitions from somewhere you don't control. Anyone verifying a cagent artifact's signature was trusting payload integrity alone before this release. Now they get provenance too.

The same release fixes a production data race in ReplaceSession, which wrote to a.session while background goroutines read it concurrently. That's the kind of bug that survives testing and then corrupts state under load.

Two other additions round out the release. The sbx-templates sandbox image ships kubectl and the AWS CLI, so agents running inside it can talk to a Kubernetes cluster or AWS directly instead of needing a custom image. The release also adds secure HTTP relay packages for configuration fetching and forwarding calls to model APIs, which points to cagent routing more of its traffic through an intermediary rather than hitting endpoints directly.

Anyone building on cagent and pushing signed artifacts should check that whatever verifies those signatures downstream reads the in-toto statement rather than assuming the old raw-bytes format. The release notes don't say whether the change is backward compatible with verifiers written against the previous signing scheme.