Skip to content
KiCI Docs

Release artifacts and digests

These are the artifacts published for KiCI v0.9.0. Pin by digest to verify you are running exactly the bits we shipped — a registry that serves substituted content fails a digest pull.

Container images

Section titled “Container images”
ImageDigest-pinned reference
kici-orchestratorquay.io/kici-dev/kici-orchestrator:0.9.0@sha256:58c36d0222832fcb82b0af33cdb46d474b97654b0051cb6c54fa96fca9a13af2
kici-agentquay.io/kici-dev/kici-agent:0.9.0@sha256:371b518421c505041bc8b52eae3ce92e888f25b2cc2d4914f32420dbbf11df55

The digest is the multi-arch manifest-list (image-index) digest, so the same reference resolves the correct image on both linux/amd64 and linux/arm64.

Verify before you run

Section titled “Verify before you run”

A digest pull fails closed if the registry serves substituted content:

Terminal window
podman pull quay.io/kici-dev/kici-orchestrator:0.9.0@sha256:58c36d0222832fcb82b0af33cdb46d474b97654b0051cb6c54fa96fca9a13af2

npm packages

Section titled “npm packages”
PackageVersionTarball integrity
@kici-dev/core0.9.0sha512-chgfJv1b2YDDW/gWJyAMAxtznC/VL7+glClkkcN+0utjkJJ4WYbR1H3XAylNGwF5Y84qZLQCdUT7d++KLJEtQQ==
@kici-dev/shared0.9.0pending registry propagation
@kici-dev/engine0.9.0sha512-1jV/acSqQ2gqgMGKX8/Iv+0qQvEa18ow5dhdYS8ClJ+YkVeR9zJ+0AxQ0oxC9aedUp7lXMgV/A2Ss+Kd2FQaIw==
@kici-dev/sdk0.9.0sha512-pTw905wG0fJL3lNcoLmH5NYre6Ce73+LFf44ti83zZ3ufoWd9rOy6ctNWcZjyc38LXFJysa/HRFvSIu1gVt//A==
@kici-dev/compiler0.9.0pending registry propagation
@kici-dev/orchestrator0.9.0pending registry propagation
@kici-dev/agent0.9.0pending registry propagation
kici0.9.0pending registry propagation
kici-admin0.9.0pending registry propagation

KiCI tarballs do not carry npm-registry provenance attestations: npm mints those from a supported CI provider’s OIDC identity, and pnpm release:prod runs interactively from an operator workstation. The integrity hashes above and the container manifest digests are the verification path.