Merge pull request #904 from crazy-max/cosign-bin-verify

cosign(install): verify binary signature with keyless verification bundle
Merge pull request #905 from docker/bot/docker-releases-json
2025-12-18 09:19:02 +01:00 · 2025-12-18 09:18:30 +01:00 · 2025-12-18 00:31:44 +00:00 · 2025-12-16 19:44:45 +01:00 · 2025-12-16 15:02:36 +01:00 · 2025-12-16 10:20:25 +01:00
99 changed files with 21116 additions and 5176 deletions
--- a/.eslintignore
+++ b/.eslintignore
@@ -1,4 +0,0 @@
-/.yarn/**
-/lib/**
-/coverage/**
-/node_modules/**
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -1,36 +0,0 @@
-{
-  "env": {
-    "node": true,
-    "es6": true,
-    "mocha": true,
-    "jest": true
-  },
-  "extends": [
-    "eslint:recommended",
-    "plugin:@typescript-eslint/eslint-recommended",
-    "plugin:@typescript-eslint/recommended",
-    "plugin:import/errors",
-    "plugin:import/typescript", // this is needed to allow importing typescript files from JS
-    "plugin:import/warnings",
-    "plugin:jest/recommended",
-    "plugin:prettier/recommended"
-  ],
-  "parser": "@typescript-eslint/parser",
-  "parserOptions": {
-    "ecmaVersion": 2023,
-    "sourceType": "module"
-  },
-  "plugins": [
-    "@typescript-eslint",
-    "jest",
-    "prettier"
-  ],
-  "rules": {
-    "import/no-unresolved": [
-      "error", {
-        "ignore": ["csv-parse/sync", "@octokit/openapi-types"]
-      }
-    ],
-    "jest/no-disabled-tests": 0
-  }
-}
--- a/.github/actions/macos-setup-qemu/action.yml
+++ b/.github/actions/macos-setup-qemu/action.yml
@@ -1,17 +0,0 @@
-name: 'Setup QEMU on macOS'
-description: 'Set up QEMU on macOS runners'
-
-# FIXME: Remove this composite once QEMU issue is fixed on macOS runners
-#  https://github.com/docker/actions-toolkit/issues/455
-
-runs:
-  using: composite
-  steps:
-    - run: |
-        set -ex
-        brew uninstall --ignore-dependencies qemu || true
-        brew autoremove || true
-        curl -o /tmp/qemu.rb https://raw.githubusercontent.com/Homebrew/homebrew-core/f1a9cf104a9a51779c7a532b658c490f69974839/Formula/q/qemu.rb
-        brew install /tmp/qemu.rb
-      continue-on-error: true
-      shell: bash
--- a/.github/buildx-lab-releases.json
+++ b/.github/buildx-lab-releases.json
@@ -1,120 +1,474 @@
 {
  "latest": {
-    "id": 206838212,
-    "tag_name": "v0.22.0-desktop.1",
-    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.22.0-desktop.1",
+    "id": 269523829,
+    "tag_name": "v0.30.1-desktop.2",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.30.1-desktop.2",
    "assets": [
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.darwin-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.darwin-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.darwin-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.darwin-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.darwin-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.darwin-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.freebsd-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.freebsd-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.freebsd-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.freebsd-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.freebsd-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.freebsd-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm-v6",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm-v6.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm-v6.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm-v7",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm-v7.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm-v7.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-ppc64le",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-ppc64le.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-ppc64le.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-riscv64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-riscv64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-riscv64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-s390x",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-s390x.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.linux-s390x.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.netbsd-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.netbsd-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.netbsd-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.netbsd-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.netbsd-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.netbsd-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.openbsd-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.openbsd-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.openbsd-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.openbsd-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.openbsd-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.openbsd-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.windows-amd64.exe",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.windows-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.windows-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.windows-arm64.exe",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.windows-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/buildx-v0.22.0-desktop.1.windows-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.22.0-desktop.1/checksums.txt"
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/checksums.txt"
+    ]
+  },
+  "v0.30.1-desktop.2": {
+    "id": 269523829,
+    "tag_name": "v0.30.1-desktop.2",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.30.1-desktop.2",
+    "assets": [
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/checksums.txt"
+    ]
+  },
+  "v0.30.1-desktop.1": {
+    "id": 264746294,
+    "tag_name": "v0.30.1-desktop.1",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.30.1-desktop.1",
+    "assets": [
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/buildx-v0.30.1-desktop.1.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.1/checksums.txt"
    ]
  },
  "edge": {
-    "id": 212733747,
-    "tag_name": "v0.23.0-desktop.1",
-    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.23.0-desktop.1",
+    "id": 269523829,
+    "tag_name": "v0.30.1-desktop.2",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.30.1-desktop.2",
    "assets": [
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.darwin-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.darwin-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.darwin-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.darwin-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.darwin-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.darwin-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.freebsd-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.freebsd-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.freebsd-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.freebsd-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.freebsd-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.freebsd-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm-v6",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm-v6.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm-v6.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm-v7",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm-v7.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm-v7.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-ppc64le",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-ppc64le.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-ppc64le.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-riscv64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-riscv64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-riscv64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-s390x",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-s390x.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.linux-s390x.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.netbsd-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.netbsd-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.netbsd-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.netbsd-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.netbsd-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.netbsd-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.openbsd-amd64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.openbsd-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.openbsd-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.openbsd-arm64",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.openbsd-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.openbsd-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.windows-amd64.exe",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.windows-amd64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.windows-amd64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.windows-arm64.exe",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.windows-arm64.provenance.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/buildx-v0.23.0-desktop.1.windows-arm64.sbom.json",
-      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/checksums.txt"
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/buildx-v0.30.1-desktop.2.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.30.1-desktop.2/checksums.txt"
+    ]
+  },
+  "v0.28.0-desktop.1": {
+    "id": 245038026,
+    "tag_name": "v0.28.0-desktop.1",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.28.0-desktop.1",
+    "assets": [
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/buildx-v0.28.0-desktop.1.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.28.0-desktop.1/checksums.txt"
+    ]
+  },
+  "v0.26.1-desktop.1": {
+    "id": 234386442,
+    "tag_name": "v0.26.1-desktop.1",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.26.1-desktop.1",
+    "assets": [
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/buildx-v0.26.1-desktop.1.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.26.1-desktop.1/checksums.txt"
+    ]
+  },
+  "v0.25.0-desktop.1": {
+    "id": 226626248,
+    "tag_name": "v0.25.0-desktop.1",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.25.0-desktop.1",
+    "assets": [
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/buildx-v0.25.0-desktop.1.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.25.0-desktop.1/checksums.txt"
+    ]
+  },
+  "v0.24.0-desktop.2": {
+    "id": 226611090,
+    "tag_name": "v0.24.0-desktop.2",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.24.0-desktop.2",
+    "assets": [
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/buildx-v0.24.0-desktop.2.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.24.0-desktop.2/checksums.txt"
    ]
  },
  "v0.23.0-desktop.1": {
@@ -176,6 +530,65 @@
      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.1/checksums.txt"
    ]
  },
+  "v0.23.0-desktop.3": {
+    "id": 219348332,
+    "tag_name": "v0.23.0-desktop.3",
+    "html_url": "https://github.com/docker/buildx-desktop/releases/tag/v0.23.0-desktop.3",
+    "assets": [
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.darwin-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.darwin-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.darwin-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.darwin-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.darwin-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.darwin-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.freebsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.freebsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.freebsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.freebsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.freebsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.freebsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm-v6",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm-v6.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm-v6.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm-v7",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm-v7.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm-v7.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-ppc64le",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-ppc64le.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-ppc64le.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-riscv64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-riscv64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-riscv64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-s390x",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-s390x.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.linux-s390x.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.netbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.netbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.netbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.netbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.netbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.netbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.openbsd-amd64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.openbsd-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.openbsd-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.openbsd-arm64",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.openbsd-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.openbsd-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.windows-amd64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.windows-amd64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.windows-amd64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.windows-arm64.exe",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.windows-arm64.provenance.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/buildx-v0.23.0-desktop.3.windows-arm64.sbom.json",
+      "https://github.com/docker/buildx-desktop/releases/download/v0.23.0-desktop.3/checksums.txt"
+    ]
+  },
  "v0.22.0-desktop.1": {
    "id": 206838212,
    "tag_name": "v0.22.0-desktop.1",
--- a/.github/buildx-releases.json
+++ b/.github/buildx-releases.json
--- a/.github/compose-lab-releases.json
+++ b/.github/compose-lab-releases.json
@@ -1,44 +1,290 @@
 {
  "latest": {
-    "id": 213661832,
-    "tag_name": "v2.35.1-desktop.1",
-    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.35.1-desktop.1",
+    "id": 226893983,
+    "tag_name": "v2.37.2-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.37.2-desktop.1",
    "assets": [
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/LICENSE",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/checksums.txt",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-aarch64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-aarch64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-aarch64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-x86_64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-x86_64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-x86_64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-aarch64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-aarch64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-aarch64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv6",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv6.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv6.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv7",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv7.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv7.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-ppc64le",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-ppc64le.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-ppc64le.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-riscv64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-riscv64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-riscv64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-s390x",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-s390x.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-s390x.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-x86_64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-x86_64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-x86_64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-aarch64.exe",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-aarch64.exe.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-aarch64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-x86_64.exe",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-x86_64.exe.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-x86_64.sbom.json"
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.sbom.json"
+    ]
+  },
+  "v2.37.2-desktop.1": {
+    "id": 226893983,
+    "tag_name": "v2.37.2-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.37.2-desktop.1",
+    "assets": [
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.sbom.json"
+    ]
+  },
+  "v2.37.1-desktop.1": {
+    "id": 226760666,
+    "tag_name": "v2.37.1-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.37.1-desktop.1",
+    "assets": [
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.1-desktop.1/docker-compose-windows-x86_64.sbom.json"
+    ]
+  },
+  "v2.37.0-desktop.1": {
+    "id": 226759025,
+    "tag_name": "v2.37.0-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.37.0-desktop.1",
+    "assets": [
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.0-desktop.1/docker-compose-windows-x86_64.sbom.json"
+    ]
+  },
+  "v2.36.2-desktop.1": {
+    "id": 226756322,
+    "tag_name": "v2.36.2-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.36.2-desktop.1",
+    "assets": [
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.2-desktop.1/docker-compose-windows-x86_64.sbom.json"
+    ]
+  },
+  "v2.36.1-desktop.1": {
+    "id": 226754489,
+    "tag_name": "v2.36.1-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.36.1-desktop.1",
+    "assets": [
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.1-desktop.1/docker-compose-windows-x86_64.sbom.json"
+    ]
+  },
+  "v2.36.0-desktop.1": {
+    "id": 226752960,
+    "tag_name": "v2.36.0-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.36.0-desktop.1",
+    "assets": [
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/LICENSE",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.36.0-desktop.1/docker-compose-windows-x86_64.sbom.json"
    ]
  },
  "v2.35.1-desktop.1": {
@@ -923,45 +1169,44 @@
    ]
  },
  "edge": {
-    "id": 213661832,
-    "tag_name": "v2.35.1-desktop.1",
-    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.35.1-desktop.1",
+    "id": 226893983,
+    "tag_name": "v2.37.2-desktop.1",
+    "html_url": "https://github.com/docker/compose-desktop/releases/tag/v2.37.2-desktop.1",
    "assets": [
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/LICENSE",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/checksums.txt",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-aarch64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-aarch64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-aarch64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-x86_64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-x86_64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-darwin-x86_64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-aarch64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-aarch64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-aarch64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv6",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv6.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv6.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv7",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv7.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-armv7.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-ppc64le",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-ppc64le.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-ppc64le.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-riscv64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-riscv64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-riscv64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-s390x",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-s390x.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-s390x.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-x86_64",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-x86_64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-linux-x86_64.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-aarch64.exe",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-aarch64.exe.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-aarch64.sbom.json",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-x86_64.exe",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-x86_64.exe.sha256",
-      "https://github.com/docker/compose-desktop/releases/download/v2.35.1-desktop.1/docker-compose-windows-x86_64.sbom.json"
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/checksums.txt",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose-desktop/releases/download/v2.37.2-desktop.1/docker-compose-windows-x86_64.sbom.json"
    ]
  },
  "v2.23.3-desktop.1": {
--- a/.github/compose-releases.json
+++ b/.github/compose-releases.json
--- a/.github/cosign-releases.json
+++ b/.github/cosign-releases.json
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,7 @@
 version: 2
 updates:
  - package-ecosystem: "github-actions"
+    open-pull-requests-limit: 20
    directory: "/"
    schedule:
      interval: "daily"
@@ -8,6 +9,7 @@ updates:
      - "dependencies"
      - "bot"
  - package-ecosystem: "npm"
+    open-pull-requests-limit: 20
    directory: "/"
    schedule:
      interval: "daily"
--- a/.github/docker-releases.json
+++ b/.github/docker-releases.json
@@ -1,8 +1,248 @@
 {
  "latest": {
-    "id": 213296967,
-    "tag_name": "v28.1.1",
-    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.1",
+    "id": 269884470,
+    "tag_name": "docker-v29.1.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.3",
+    "assets": []
+  },
+  "edge": {
+    "id": 271147963,
+    "tag_name": "docker-v29.2.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.2.0-rc.1",
+    "assets": []
+  },
+  "v29.2.0-rc.1": {
+    "id": 271147963,
+    "tag_name": "docker-v29.2.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.2.0-rc.1",
+    "assets": []
+  },
+  "v29.1.3": {
+    "id": 269884470,
+    "tag_name": "docker-v29.1.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.3",
+    "assets": []
+  },
+  "v29.1.2": {
+    "id": 266898070,
+    "tag_name": "docker-v29.1.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.2",
+    "assets": []
+  },
+  "v29.1.1": {
+    "id": 265971746,
+    "tag_name": "docker-v29.1.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.1",
+    "assets": []
+  },
+  "v29.1.0": {
+    "id": 265770897,
+    "tag_name": "docker-v29.1.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.0",
+    "assets": []
+  },
+  "v29.0.4": {
+    "id": 264940208,
+    "tag_name": "docker-v29.0.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.4",
+    "assets": []
+  },
+  "v29.0.3": {
+    "id": 264058657,
+    "tag_name": "docker-v29.0.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.3",
+    "assets": []
+  },
+  "v29.0.2": {
+    "id": 262951416,
+    "tag_name": "docker-v29.0.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.2",
+    "assets": []
+  },
+  "v29.1.0-rc.1": {
+    "id": 263125085,
+    "tag_name": "docker-v29.1.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.0-rc.1",
+    "assets": []
+  },
+  "v29.0.1": {
+    "id": 262245944,
+    "tag_name": "docker-v29.0.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.1",
+    "assets": []
+  },
+  "v29.0.0": {
+    "id": 261265152,
+    "tag_name": "docker-v29.0.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0",
+    "assets": []
+  },
+  "v29.0.0-rc.3": {
+    "id": 260452080,
+    "tag_name": "docker-v29.0.0-rc.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.3",
+    "assets": []
+  },
+  "v28.5.2": {
+    "id": 259852183,
+    "tag_name": "v28.5.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.2",
+    "assets": []
+  },
+  "v29.0.0-rc.2": {
+    "id": 258289954,
+    "tag_name": "docker-v29.0.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.2",
+    "assets": []
+  },
+  "v29.0.0-rc.1": {
+    "id": 252020476,
+    "tag_name": "docker-v29.0.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.1",
+    "assets": []
+  },
+  "v28.5.1": {
+    "id": 252833798,
+    "tag_name": "v28.5.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.1",
+    "assets": []
+  },
+  "v28.5.0": {
+    "id": 251798390,
+    "tag_name": "v28.5.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.0",
+    "assets": []
+  },
+  "v28.5.0-rc.1": {
+    "id": 249763924,
+    "tag_name": "v28.5.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.0-rc.1",
+    "assets": []
+  },
+  "v28.4.0": {
+    "id": 244504005,
+    "tag_name": "v28.4.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.4.0",
+    "assets": []
+  },
+  "v28.4.0-rc.2": {
+    "id": 244065281,
+    "tag_name": "v28.4.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.4.0-rc.2",
+    "assets": []
+  },
+  "v28.4.0-rc.1": {
+    "id": 243821467,
+    "tag_name": "v28.4.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.4.0-rc.1",
+    "assets": []
+  },
+  "v25.0.13": {
+    "id": 244806783,
+    "tag_name": "v25.0.13",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.13",
+    "assets": []
+  },
+  "v28.3.3": {
+    "id": 235196329,
+    "tag_name": "v28.3.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.3",
+    "assets": []
+  },
+  "v25.0.12": {
+    "id": 232634573,
+    "tag_name": "v25.0.12",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.12",
+    "assets": []
+  },
+  "v28.3.2": {
+    "id": 231184033,
+    "tag_name": "v28.3.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.2",
+    "assets": []
+  },
+  "v28.3.1": {
+    "id": 229534501,
+    "tag_name": "v28.3.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.1",
+    "assets": []
+  },
+  "v28.3.0": {
+    "id": 227302240,
+    "tag_name": "v28.3.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0",
+    "assets": []
+  },
+  "v28.3.0-rc.2": {
+    "id": 226745561,
+    "tag_name": "v28.3.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0-rc.2",
+    "assets": []
+  },
+  "v25.0.11": {
+    "id": 226304708,
+    "tag_name": "v25.0.11",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.11",
+    "assets": []
+  },
+  "v28.3.0-rc.1": {
+    "id": 225132759,
+    "tag_name": "v28.3.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0-rc.1",
+    "assets": []
+  },
+  "v28.2.2": {
+    "id": 222034216,
+    "tag_name": "v28.2.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.2",
+    "assets": []
+  },
+  "v28.2.1": {
+    "id": 221664376,
+    "tag_name": "v28.2.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.1",
+    "assets": []
+  },
+  "v28.2.0": {
+    "id": 221225663,
+    "tag_name": "v28.2.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0",
+    "assets": []
+  },
+  "v28.2.0-rc.2": {
+    "id": 220155575,
+    "tag_name": "v28.2.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.2",
+    "assets": []
+  },
+  "v28.2.0-rc.1": {
+    "id": 218898330,
+    "tag_name": "v28.2.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.1",
+    "assets": []
+  },
+  "v25.0.10": {
+    "id": 218958962,
+    "tag_name": "v25.0.10",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.10",
+    "assets": []
+  },
+  "v25.0.9": {
+    "id": 218957753,
+    "tag_name": "v25.0.9",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.9",
+    "assets": []
+  },
+  "v23.0.18": {
+    "id": 218962082,
+    "tag_name": "v23.0.18",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.18",
+    "assets": []
+  },
+  "v23.0.17": {
+    "id": 218961915,
+    "tag_name": "v23.0.17",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.17",
    "assets": []
  },
  "v28.1.1": {
@@ -17,12 +257,6 @@
    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0",
    "assets": []
  },
-  "edge": {
-    "id": 213296967,
-    "tag_name": "v28.1.1",
-    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.1",
-    "assets": []
-  },
  "v28.1.0-rc.2": {
    "id": 212786864,
    "tag_name": "v28.1.0-rc.2",
--- a/.github/regclient-releases.json
+++ b/.github/regclient-releases.json
@@ -1,31 +1,223 @@
 {
  "latest": {
-    "id": 214324874,
-    "tag_name": "v0.8.3",
-    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.8.3",
+    "id": 268115419,
+    "tag_name": "v0.11.1",
+    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.11.1",
    "assets": [
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/metadata.tgz",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regbot-darwin-amd64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regbot-darwin-arm64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regbot-linux-amd64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regbot-linux-arm64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regbot-linux-ppc64le",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regbot-linux-s390x",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regbot-windows-amd64.exe",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regctl-darwin-amd64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regctl-darwin-arm64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regctl-linux-amd64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regctl-linux-arm64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regctl-linux-ppc64le",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regctl-linux-s390x",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regctl-windows-amd64.exe",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regsync-darwin-amd64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regsync-darwin-arm64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regsync-linux-amd64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regsync-linux-arm64",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regsync-linux-ppc64le",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regsync-linux-s390x",
-      "https://github.com/regclient/regclient/releases/download/v0.8.3/regsync-windows-amd64.exe"
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/metadata.tgz",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-windows-amd64.exe"
+    ]
+  },
+  "v0.11.1": {
+    "id": 268115419,
+    "tag_name": "v0.11.1",
+    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.11.1",
+    "assets": [
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/metadata.tgz",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regbot-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regctl-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.1/regsync-windows-amd64.exe"
+    ]
+  },
+  "v0.11.0": {
+    "id": 266508831,
+    "tag_name": "v0.11.0",
+    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.11.0",
+    "assets": [
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/metadata.tgz",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regbot-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regctl-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-freebsd-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-linux-riscv64",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.11.0/regsync-windows-amd64.exe"
+    ]
+  },
+  "v0.10.0": {
+    "id": 260956263,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.10.0",
+    "assets": [
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/metadata.tgz",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regbot-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regbot-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regbot-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regbot-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regbot-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regbot-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regbot-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regctl-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regctl-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regctl-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regctl-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regctl-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regctl-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regctl-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regsync-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regsync-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regsync-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regsync-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regsync-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regsync-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.10.0/regsync-windows-amd64.exe"
+    ]
+  },
+  "v0.9.2": {
+    "id": 243486094,
+    "tag_name": "v0.9.2",
+    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.9.2",
+    "assets": [
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/metadata.tgz",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regbot-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regbot-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regbot-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regbot-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regbot-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regbot-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regbot-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regctl-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regctl-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regctl-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regctl-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regctl-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regctl-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regctl-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regsync-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regsync-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regsync-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regsync-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regsync-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regsync-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.2/regsync-windows-amd64.exe"
+    ]
+  },
+  "v0.9.1": {
+    "id": 242120089,
+    "tag_name": "v0.9.1",
+    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.9.1",
+    "assets": [
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/metadata.tgz",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regbot-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regbot-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regbot-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regbot-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regbot-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regbot-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regbot-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regctl-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regctl-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regctl-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regctl-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regctl-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regctl-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regctl-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regsync-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regsync-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regsync-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regsync-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regsync-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regsync-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.1/regsync-windows-amd64.exe"
+    ]
+  },
+  "v0.9.0": {
+    "id": 228803167,
+    "tag_name": "v0.9.0",
+    "html_url": "https://github.com/regclient/regclient/releases/tag/v0.9.0",
+    "assets": [
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/metadata.tgz",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regbot-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regbot-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regbot-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regbot-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regbot-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regbot-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regbot-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regctl-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regctl-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regctl-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regctl-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regctl-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regctl-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regctl-windows-amd64.exe",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regsync-darwin-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regsync-darwin-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regsync-linux-amd64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regsync-linux-arm64",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regsync-linux-ppc64le",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regsync-linux-s390x",
+      "https://github.com/regclient/regclient/releases/download/v0.9.0/regsync-windows-amd64.exe"
    ]
  },
  "v0.8.3": {
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,6 +19,7 @@ jobs:
      fail-fast: false
      matrix:
        node_version:
+          - 24
          - 20
          - 18
    steps:
--- a/.github/workflows/buildx-lab-releases-json.yml
+++ b/.github/workflows/buildx-lab-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
    with:
      repository: docker/buildx-desktop
      artifact_name: buildx-lab-releases-json
@@ -25,17 +25,17 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          name: buildx-lab-releases-json
          path: .github
@@ -45,7 +45,7 @@ jobs:
          git add -A .
      -
        name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
        with:
          base: main
          branch: bot/buildx-lab-releases-json
--- a/.github/workflows/buildx-releases-json.yml
+++ b/.github/workflows/buildx-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
    with:
      repository: docker/buildx
      artifact_name: buildx-releases-json
@@ -25,17 +25,17 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          name: buildx-releases-json
          path: .github
@@ -45,7 +45,7 @@ jobs:
          git add -A .
      -
        name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
        with:
          base: main
          branch: bot/buildx-releases-json
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,7 +20,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Enable corepack
        run: |
@@ -28,19 +28,19 @@ jobs:
          yarn --version
      -
        name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      -
        name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
      -
        name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
      -
        name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:javascript-typescript"
--- a/.github/workflows/compose-lab-releases-json.yml
+++ b/.github/workflows/compose-lab-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
    with:
      repository: docker/compose-desktop
      artifact_name: compose-lab-releases-json
@@ -25,17 +25,17 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          name: compose-lab-releases-json
          path: .github
@@ -45,7 +45,7 @@ jobs:
          git add -A .
      -
        name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
        with:
          base: main
          branch: bot/compose-lab-releases-json
--- a/.github/workflows/compose-releases-json.yml
+++ b/.github/workflows/compose-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
    with:
      repository: docker/compose
      artifact_name: compose-releases-json
@@ -25,17 +25,17 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          name: compose-releases-json
          path: .github
@@ -45,7 +45,7 @@ jobs:
          git add -A .
      -
        name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
        with:
          base: main
          branch: bot/compose-releases-json
--- a/.github/workflows/cosign-releases-json.yml
+++ b/.github/workflows/cosign-releases-json.yml
@@ -0,0 +1,58 @@
+name: cosign-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/cosign-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
+    with:
+      repository: sigstore/cosign
+      artifact_name: cosign-releases-json
+      filename: cosign-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Download
+        uses: actions/download-artifact@v7
+        with:
+          name: cosign-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
+        with:
+          base: main
+          branch: bot/cosign-releases-json
+          commit-message: "github: update .github/cosign-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/cosign-releases.json`"
+          body: |
+            Update `.github/cosign-releases.json` to keep in sync with [https://github.com/sigstore/cosign](https://github.com/sigstore/cosign).
+          draft: false
--- a/.github/workflows/docker-releases-json.yml
+++ b/.github/workflows/docker-releases-json.yml
@@ -17,25 +17,28 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
    with:
      repository: moby/moby
      artifact_name: docker-releases-json
      filename: docker-releases.json
+      tag_patterns: |
+        ^docker-(.*)$
+        ^(v.*)$
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          name: docker-releases-json
          path: .github
@@ -45,7 +48,7 @@ jobs:
          git add -A .
      -
        name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
        with:
          base: main
          branch: bot/docker-releases-json
--- a/.github/workflows/regclient-releases-json.yml
+++ b/.github/workflows/regclient-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
    with:
      repository: regclient/regclient
      artifact_name: regclient-releases-json
@@ -32,10 +32,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          name: regclient-releases-json
          path: .github
@@ -45,7 +45,7 @@ jobs:
          git add -A .
      -
        name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
        with:
          base: main
          branch: bot/regclient-releases-json
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,7 +16,7 @@ on:
 env:
  NODE_VERSION: "20"
  BUILDX_VERSION: "edge"
-  BUILDKIT_IMAGE: "moby/buildkit:v0.21.0"
+  BUILDKIT_IMAGE: "moby/buildkit:v0.26.2"

 jobs:
  test:
@@ -26,14 +26,15 @@ jobs:
      matrix:
        os:
          - ubuntu-latest
-          - ubuntu-22.04-arm
+          - ubuntu-24.04-arm
        node_version:
+          - 24
          - 20
          - 18
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Test
        uses: docker/bake-action@v6
@@ -68,7 +69,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Enable corepack
        run: |
@@ -76,7 +77,7 @@ jobs:
          yarn --version
      -
        name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
@@ -86,7 +87,7 @@ jobs:
      -
        name: Create includes
        id: set
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            let tests = [];
@@ -105,19 +106,24 @@ jobs:
            });
            await core.group(`Set includes`, async () => {
              let includes = [];
-              for (const os of ['ubuntu-latest', 'ubuntu-22.04-arm', 'macos-13', 'windows-latest']) {
+              for (const os of ['ubuntu-latest', 'ubuntu-24.04-arm', 'macos-15-intel', 'windows-latest']) {
                for (const test of tests) {
                  if (test === 'docker/install.test.itg.ts') {
-                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: '27.3.1' });
-                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'master' });
-                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'latest' });
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: '27.3.1' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'master' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'v26.1.4' });
                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'latest' });
+                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'v29.0.0-rc.1', docker_install_channel: 'test' });
                    if (os === 'ubuntu-latest') {
                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'image', docker_install_version: 'latest' });
                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'archive', docker_install_version: 'latest' });
                    }
-                    includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'image', docker_install_version: 'latest' });
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
                    includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'archive', docker_install_version: 'latest' });
                  } else {
                    includes.push({ os: os, test: test });
@@ -140,20 +146,24 @@ jobs:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.prepare-itg.outputs.includes) }}
+    permissions:
+      contents: read
+      id-token: write # needed for signing with GitHub OIDC Token
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Expose GitHub Runtime
        uses: crazy-max/ghaction-github-runtime@v3
      -
-        # FIXME: Needs to setup node twice on Windows due to a bug with runner
+        # FIXME: Needs to setup node twice on Windows: https://github.com/actions/setup-node/issues/1357#issuecomment-3254613964
        name: Setup Node
        if: startsWith(matrix.os, 'windows')
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
+          package-manager-cache: false
      -
        name: Enable corepack
        run: |
@@ -161,7 +171,7 @@ jobs:
          yarn --version
      -
        name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
@@ -186,7 +196,7 @@ jobs:
        run: yarn install
      -
        name: Test
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const testName = `${{ matrix.test_name }}`;
@@ -202,6 +212,7 @@ jobs:
          TEST_FOR_SUMMARY: ${{ secrets.TEST_FOR_SUMMARY }}
          DOCKER_INSTALL_TYPE: ${{ matrix.docker_install_type }}
          DOCKER_INSTALL_VERSION: ${{ matrix.docker_install_version }}
+          DOCKER_INSTALL_CHANNEL: ${{ matrix.docker_install_channel }}
      -
        name: Check coverage
        run: |
--- a/.github/workflows/undock-releases-json.yml
+++ b/.github/workflows/undock-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
    with:
      repository: crazy-max/undock
      artifact_name: undock-releases-json
@@ -25,17 +25,17 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          name: undock-releases-json
          path: .github
@@ -45,7 +45,7 @@ jobs:
          git add -A .
      -
        name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725  # v8.0.0
        with:
          base: main
          branch: bot/undock-releases-json
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -21,7 +21,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: List targets
        id: generate
--- a/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
+++ b/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -1,3 +1,9 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
 logFilters:
  - code: YN0013
    level: discard
@@ -5,11 +11,9 @@ logFilters:
    level: discard
  - code: YN0076
    level: discard
+  - code: YN0086
+    level: discard

 nodeLinker: node-modules

 npmAuthToken: "${NODE_AUTH_TOKEN:-fallback}"
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
--- a/tests/.fixtures/cosign/sign-output1.txt
+++ b/tests/.fixtures/cosign/sign-output1.txt
--- a/tests/.fixtures/cosign/sign-output2.txt
+++ b/tests/.fixtures/cosign/sign-output2.txt
--- a/tests/.fixtures/cosign/sign-output3.txt
+++ b/tests/.fixtures/cosign/sign-output3.txt
--- a/tests/.fixtures/cosign/verify-output-err1.txt
+++ b/tests/.fixtures/cosign/verify-output-err1.txt
@@ -0,0 +1,96 @@
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/
+2025/10/31 13:57:03 GET /v2/ HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 401 https://index.docker.io/v2/ (191.948348ms)
+2025/10/31 13:57:03 HTTP/2.0 401 Unauthorized
+Content-Length: 87
+Content-Type: application/json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Strict-Transport-Security: max-age=31536000
+Www-Authenticate: ***"https://auth.docker.io/token",service="registry.docker.io"
+
+{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}
+
+2025/10/31 13:57:03 --> GET https://auth.docker.io/token?scope=repository%3Acrazymax%2Fgithub-builder-test%3Apull&service=registry.docker.io [body redacted: basic token response contains credentials]
+2025/10/31 13:57:03 GET /token?scope=repository%3Acrazymax%2Fgithub-builder-test%3Apull&service=registry.docker.io HTTP/1.1
+Host: auth.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 200 https://auth.docker.io/token?scope=repository%3Acrazymax%2Fgithub-builder-test%3Apull&service=registry.docker.io (180.01561ms) [body redacted: basic token response contains credentials]
+2025/10/31 13:57:03 HTTP/2.0 200 OK
+Connection: close
+Content-Type: application/json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Strict-Transport-Security: max-age=31536000
+X-Trace-Id: 8d63fbce36baf5f2a0c5f2542efa7a7a
+X-Trace-Sampled: false
+
+
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0
+2025/10/31 13:57:03 GET /v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept: application/vnd.oci.image.index.v1+json
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 200 https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 (84.160823ms)
+2025/10/31 13:57:03 HTTP/2.0 200 OK
+Content-Length: 89
+Content-Type: application/vnd.oci.image.index.v1+json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Strict-Transport-Security: max-age=31536000
+
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[]}
+
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0
+2025/10/31 13:57:03 GET /v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept: application/vnd.oci.image.index.v1+json
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 200 https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 (95.303988ms)
+2025/10/31 13:57:03 HTTP/2.0 200 OK
+Content-Length: 89
+Content-Type: application/vnd.oci.image.index.v1+json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Strict-Transport-Security: max-age=31536000
+
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[]}
+
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/crazymax/github-builder-test/manifests/sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig
+2025/10/31 13:57:03 GET /v2/crazymax/github-builder-test/manifests/sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 404 https://index.docker.io/v2/crazymax/github-builder-test/manifests/sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig (66.155995ms)
+2025/10/31 13:57:03 HTTP/2.0 404 Not Found
+Content-Length: 169
+Content-Type: application/json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Docker-Ratelimit-Source: d2fd3209-1e2e-451f-b428-29c5bbf3b4b7
+Strict-Transport-Security: max-age=31536000
+
+{"errors":[{"code":"MANIFEST_UNKNOWN","message":"manifest unknown","detail":"unknown tag=sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig"}]}
+
+Error: no signatures found
+error during command execution: no signatures found
--- a/tests/.fixtures/imagetools-03.json
+++ b/tests/.fixtures/imagetools-03.json
@@ -0,0 +1,5 @@
+{
+  "mediaType": "application/vnd.oci.image.manifest.v1+json",
+  "digest": "sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+  "size": 1599
+}
--- a/tests/.fixtures/imagetools-04.json
+++ b/tests/.fixtures/imagetools-04.json
@@ -0,0 +1,141 @@
+{
+  "schemaVersion": 2,
+  "mediaType": "application/vnd.oci.image.index.v1+json",
+  "digest": "sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6",
+  "size": 4654,
+  "manifests": [
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+      "size": 1599,
+      "platform": {
+        "architecture": "amd64",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+      "size": 1599,
+      "platform": {
+        "architecture": "arm",
+        "os": "linux",
+        "variant": "v7"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:8f251fda6057e9dffc54f7874b249920f15f1813e9b1406a0cebeca5e4ab1ad9",
+      "size": 1599,
+      "platform": {
+        "architecture": "arm64",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:d306cbc2d506547f136c8e0ea040b929743f298fb2813d9030efdb9d9eee4d51",
+      "size": 1599,
+      "platform": {
+        "architecture": "s390x",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:9d195ff2dc9ef347bb52ebb1c2a6e6587d4bd87019d2ea11df3e7046a3d19708",
+      "size": 1599,
+      "platform": {
+        "architecture": "ppc64le",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:72410c2c4529fca9339ebbcc8db2a1d5cb4d72d72c669f50b6d45d8a0f79fc22",
+      "size": 1599,
+      "platform": {
+        "architecture": "riscv64",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:241b7159129d53923c89708bcc052b3398086a826519896be2f025545916e43e",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:8f251fda6057e9dffc54f7874b249920f15f1813e9b1406a0cebeca5e4ab1ad9",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:97f4a222a7992dba6dc1a43991d0cca1fcffdc25593033c6a3a7ff14c8651cbf",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:d306cbc2d506547f136c8e0ea040b929743f298fb2813d9030efdb9d9eee4d51",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:aa933713d8094b2708120e889acb6f7153dee4e0f3298ccd3e37a584cd0c260d",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:9d195ff2dc9ef347bb52ebb1c2a6e6587d4bd87019d2ea11df3e7046a3d19708",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:d95ca72d4f2a6bc416d4b2f3003b2af9d5f4dea99acec6ad3ab0c2082000a98c",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:72410c2c4529fca9339ebbcc8db2a1d5cb4d72d72c669f50b6d45d8a0f79fc22",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    }
+  ]
+}
--- a/tests/.fixtures/imagetools-05.json
+++ b/tests/.fixtures/imagetools-05.json
@@ -0,0 +1,80 @@
+[
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:241b7159129d53923c89708bcc052b3398086a826519896be2f025545916e43e",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:8f251fda6057e9dffc54f7874b249920f15f1813e9b1406a0cebeca5e4ab1ad9",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:97f4a222a7992dba6dc1a43991d0cca1fcffdc25593033c6a3a7ff14c8651cbf",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:d306cbc2d506547f136c8e0ea040b929743f298fb2813d9030efdb9d9eee4d51",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:aa933713d8094b2708120e889acb6f7153dee4e0f3298ccd3e37a584cd0c260d",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:9d195ff2dc9ef347bb52ebb1c2a6e6587d4bd87019d2ea11df3e7046a3d19708",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:d95ca72d4f2a6bc416d4b2f3003b2af9d5f4dea99acec6ad3ab0c2082000a98c",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:72410c2c4529fca9339ebbcc8db2a1d5cb4d72d72c669f50b6d45d8a0f79fc22",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  }
+]
--- a/tests/.fixtures/sigstore/multi/linux_amd64/hello.txt
+++ b/tests/.fixtures/sigstore/multi/linux_amd64/hello.txt
@@ -0,0 +1 @@
+Hello, World! This is linux/amd64
--- a/tests/.fixtures/sigstore/multi/linux_amd64/provenance.json
+++ b/tests/.fixtures/sigstore/multi/linux_amd64/provenance.json
@@ -0,0 +1,462 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "hello.txt",
+      "digest": {
+        "sha256": "1b37929e66644beb58b3d28d44fba0d82aa90cab03c55a492adb81fe6e833ec8"
+      }
+    }
+  ],
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md",
+      "resolvedDependencies": [
+        {
+          "uri": "pkg:docker/docker/buildkit-syft-scanner@stable-1",
+          "digest": {
+            "sha256": "e930c2697be77cb7271d316ecfa78768b5eac73de3b16018ed38eb0ea0b5a7cb"
+          }
+        },
+        {
+          "uri": "pkg:docker/alpine@latest?platform=linux%2Famd64",
+          "digest": {
+            "sha256": "4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+          }
+        },
+        {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          }
+        }
+      ],
+      "externalParameters": {
+        "configSource": {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          },
+          "path": "hello.Dockerfile"
+        },
+        "request": {
+          "frontend": "dockerfile.v0",
+          "secrets": [
+            {
+              "id": "GIT_AUTH_HEADER",
+              "optional": true
+            },
+            {
+              "id": "GIT_AUTH_TOKEN",
+              "optional": true
+            }
+          ]
+        }
+      },
+      "internalParameters": {
+        "buildConfig": {
+          "digestMapping": {
+            "sha256:23dcbc3cce701a8a9bbb1e33f2ea88304527a4a935c89c4564af698095463ac2": "step3",
+            "sha256:3192c1bd53f90cca959db778dcee30edc9a79f8cd3f9a2c54adc4606507fd3b6": "step0",
+            "sha256:7f1c9e959980ea3e2cf4af8ef97b6c3797a0926752b436bff11474e436defe7f": "step1",
+            "sha256:c8737331fb8e5f5bcb6b22320012d975057514982c788e63db13332a4219b984": "step2"
+          },
+          "llbDefinition": [
+            {
+              "id": "step0",
+              "op": {
+                "Op": {
+                  "source": {
+                    "identifier": "docker-image://docker.io/library/alpine:latest@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step1",
+              "inputs": [
+                "step0:0"
+              ],
+              "op": {
+                "Op": {
+                  "exec": {
+                    "meta": {
+                      "args": [
+                        "/bin/sh",
+                        "-c",
+                        "echo \"Hello, World! This is ${TARGETPLATFORM}\" \u003e /hello.txt"
+                      ],
+                      "cwd": "/",
+                      "env": [
+                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        "TARGETPLATFORM=linux/amd64"
+                      ],
+                      "removeMountStubsRecursive": true
+                    },
+                    "mounts": [
+                      {
+                        "dest": "/"
+                      }
+                    ]
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step2",
+              "inputs": [
+                "step1:0"
+              ],
+              "op": {
+                "Op": {
+                  "file": {
+                    "actions": [
+                      {
+                        "Action": {
+                          "copy": {
+                            "allowEmptyWildcard": true,
+                            "allowWildcard": true,
+                            "createDestPath": true,
+                            "dest": "/",
+                            "dirCopyContents": true,
+                            "followSymlink": true,
+                            "mode": -1,
+                            "src": "/hello.txt",
+                            "timestamp": -1
+                          }
+                        },
+                        "input": -1,
+                        "output": 0,
+                        "secondaryInput": 0
+                      }
+                    ]
+                  }
+                },
+                "constraints": {}
+              }
+            },
+            {
+              "id": "step3",
+              "inputs": [
+                "step2:0"
+              ],
+              "op": {
+                "Op": {}
+              }
+            }
+          ]
+        },
+        "builderPlatform": "linux/amd64",
+        "github_actor": "crazy-max",
+        "github_actor_id": "1951866",
+        "github_event_name": "workflow_dispatch",
+        "github_event_payload": {
+          "enterprise": {
+            "avatar_url": "https://avatars.githubusercontent.com/b/19176?v=4",
+            "created_at": "2022-12-30T23:53:17Z",
+            "description": null,
+            "html_url": "https://github.com/enterprises/docker",
+            "id": 19176,
+            "name": "Docker",
+            "node_id": "E_kgDNSug",
+            "slug": "docker",
+            "updated_at": "2025-10-20T20:39:05Z",
+            "website_url": null
+          },
+          "inputs": null,
+          "organization": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+            "description": "Docker helps developers bring their ideas to life by conquering the complexity of app development.",
+            "events_url": "https://api.github.com/orgs/docker/events",
+            "hooks_url": "https://api.github.com/orgs/docker/hooks",
+            "id": 5429470,
+            "issues_url": "https://api.github.com/orgs/docker/issues",
+            "login": "docker",
+            "members_url": "https://api.github.com/orgs/docker/members{/member}",
+            "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+            "public_members_url": "https://api.github.com/orgs/docker/public_members{/member}",
+            "repos_url": "https://api.github.com/orgs/docker/repos",
+            "url": "https://api.github.com/orgs/docker"
+          },
+          "ref": "refs/heads/main",
+          "repository": {
+            "allow_forking": true,
+            "archive_url": "https://api.github.com/repos/docker/github-builder-test/{archive_format}{/ref}",
+            "archived": false,
+            "assignees_url": "https://api.github.com/repos/docker/github-builder-test/assignees{/user}",
+            "blobs_url": "https://api.github.com/repos/docker/github-builder-test/git/blobs{/sha}",
+            "branches_url": "https://api.github.com/repos/docker/github-builder-test/branches{/branch}",
+            "clone_url": "https://github.com/docker/github-builder-test.git",
+            "collaborators_url": "https://api.github.com/repos/docker/github-builder-test/collaborators{/collaborator}",
+            "comments_url": "https://api.github.com/repos/docker/github-builder-test/comments{/number}",
+            "commits_url": "https://api.github.com/repos/docker/github-builder-test/commits{/sha}",
+            "compare_url": "https://api.github.com/repos/docker/github-builder-test/compare/{base}...{head}",
+            "contents_url": "https://api.github.com/repos/docker/github-builder-test/contents/{+path}",
+            "contributors_url": "https://api.github.com/repos/docker/github-builder-test/contributors",
+            "created_at": "2025-08-19T08:08:29Z",
+            "custom_properties": {},
+            "default_branch": "main",
+            "deployments_url": "https://api.github.com/repos/docker/github-builder-test/deployments",
+            "description": "Test repo for https://github.com/docker/github-builder-experimental",
+            "disabled": false,
+            "downloads_url": "https://api.github.com/repos/docker/github-builder-test/downloads",
+            "events_url": "https://api.github.com/repos/docker/github-builder-test/events",
+            "fork": false,
+            "forks": 0,
+            "forks_count": 0,
+            "forks_url": "https://api.github.com/repos/docker/github-builder-test/forks",
+            "full_name": "docker/github-builder-test",
+            "git_commits_url": "https://api.github.com/repos/docker/github-builder-test/git/commits{/sha}",
+            "git_refs_url": "https://api.github.com/repos/docker/github-builder-test/git/refs{/sha}",
+            "git_tags_url": "https://api.github.com/repos/docker/github-builder-test/git/tags{/sha}",
+            "git_url": "git://github.com/docker/github-builder-test.git",
+            "has_discussions": false,
+            "has_downloads": true,
+            "has_issues": false,
+            "has_pages": false,
+            "has_projects": false,
+            "has_wiki": false,
+            "homepage": null,
+            "hooks_url": "https://api.github.com/repos/docker/github-builder-test/hooks",
+            "html_url": "https://github.com/docker/github-builder-test",
+            "id": 1040594287,
+            "is_template": false,
+            "issue_comment_url": "https://api.github.com/repos/docker/github-builder-test/issues/comments{/number}",
+            "issue_events_url": "https://api.github.com/repos/docker/github-builder-test/issues/events{/number}",
+            "issues_url": "https://api.github.com/repos/docker/github-builder-test/issues{/number}",
+            "keys_url": "https://api.github.com/repos/docker/github-builder-test/keys{/key_id}",
+            "labels_url": "https://api.github.com/repos/docker/github-builder-test/labels{/name}",
+            "language": "Dockerfile",
+            "languages_url": "https://api.github.com/repos/docker/github-builder-test/languages",
+            "license": null,
+            "merges_url": "https://api.github.com/repos/docker/github-builder-test/merges",
+            "milestones_url": "https://api.github.com/repos/docker/github-builder-test/milestones{/number}",
+            "mirror_url": null,
+            "name": "github-builder-test",
+            "node_id": "R_kgDOPgY1bw",
+            "notifications_url": "https://api.github.com/repos/docker/github-builder-test/notifications{?since,all,participating}",
+            "open_issues": 0,
+            "open_issues_count": 0,
+            "owner": {
+              "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+              "events_url": "https://api.github.com/users/docker/events{/privacy}",
+              "followers_url": "https://api.github.com/users/docker/followers",
+              "following_url": "https://api.github.com/users/docker/following{/other_user}",
+              "gists_url": "https://api.github.com/users/docker/gists{/gist_id}",
+              "gravatar_id": "",
+              "html_url": "https://github.com/docker",
+              "id": 5429470,
+              "login": "docker",
+              "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+              "organizations_url": "https://api.github.com/users/docker/orgs",
+              "received_events_url": "https://api.github.com/users/docker/received_events",
+              "repos_url": "https://api.github.com/users/docker/repos",
+              "site_admin": false,
+              "starred_url": "https://api.github.com/users/docker/starred{/owner}{/repo}",
+              "subscriptions_url": "https://api.github.com/users/docker/subscriptions",
+              "type": "Organization",
+              "url": "https://api.github.com/users/docker",
+              "user_view_type": "public"
+            },
+            "private": true,
+            "pulls_url": "https://api.github.com/repos/docker/github-builder-test/pulls{/number}",
+            "pushed_at": "2025-10-30T10:04:10Z",
+            "releases_url": "https://api.github.com/repos/docker/github-builder-test/releases{/id}",
+            "size": 25,
+            "ssh_url": "git@github.com:docker/github-builder-test.git",
+            "stargazers_count": 0,
+            "stargazers_url": "https://api.github.com/repos/docker/github-builder-test/stargazers",
+            "statuses_url": "https://api.github.com/repos/docker/github-builder-test/statuses/{sha}",
+            "subscribers_url": "https://api.github.com/repos/docker/github-builder-test/subscribers",
+            "subscription_url": "https://api.github.com/repos/docker/github-builder-test/subscription",
+            "svn_url": "https://github.com/docker/github-builder-test",
+            "tags_url": "https://api.github.com/repos/docker/github-builder-test/tags",
+            "teams_url": "https://api.github.com/repos/docker/github-builder-test/teams",
+            "topics": [],
+            "trees_url": "https://api.github.com/repos/docker/github-builder-test/git/trees{/sha}",
+            "updated_at": "2025-10-30T10:04:14Z",
+            "url": "https://api.github.com/repos/docker/github-builder-test",
+            "visibility": "internal",
+            "watchers": 0,
+            "watchers_count": 0,
+            "web_commit_signoff_required": false
+          },
+          "sender": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/1951866?v=4",
+            "events_url": "https://api.github.com/users/crazy-max/events{/privacy}",
+            "followers_url": "https://api.github.com/users/crazy-max/followers",
+            "following_url": "https://api.github.com/users/crazy-max/following{/other_user}",
+            "gists_url": "https://api.github.com/users/crazy-max/gists{/gist_id}",
+            "gravatar_id": "",
+            "html_url": "https://github.com/crazy-max",
+            "id": 1951866,
+            "login": "crazy-max",
+            "node_id": "MDQ6VXNlcjE5NTE4NjY=",
+            "organizations_url": "https://api.github.com/users/crazy-max/orgs",
+            "received_events_url": "https://api.github.com/users/crazy-max/received_events",
+            "repos_url": "https://api.github.com/users/crazy-max/repos",
+            "site_admin": false,
+            "starred_url": "https://api.github.com/users/crazy-max/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/crazy-max/subscriptions",
+            "type": "User",
+            "url": "https://api.github.com/users/crazy-max",
+            "user_view_type": "public"
+          },
+          "workflow": ".github/workflows/ci.yml"
+        },
+        "github_job": "build",
+        "github_ref": "refs/heads/main",
+        "github_ref_name": "main",
+        "github_ref_protected": "false",
+        "github_ref_type": "branch",
+        "github_repository": "docker/github-builder-test",
+        "github_repository_id": "1040594287",
+        "github_repository_owner": "docker",
+        "github_repository_owner_id": "5429470",
+        "github_run_attempt": "1",
+        "github_run_id": "18937328894",
+        "github_run_number": "183",
+        "github_runner_arch": "X64",
+        "github_runner_environment": "github-hosted",
+        "github_runner_image_os": "ubuntu24",
+        "github_runner_image_version": "20250929.60.1",
+        "github_runner_name": "GitHub Actions 1002376925",
+        "github_runner_os": "Linux",
+        "github_runner_tracking_id": "github_7c0a7521-2999-41e5-af30-b7f0681f204f",
+        "github_server_url": "https://github.com",
+        "github_triggering_actor": "crazy-max",
+        "github_workflow": "ci",
+        "github_workflow_ref": "docker/github-builder-test/.github/workflows/ci.yml@refs/heads/main",
+        "github_workflow_sha": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+      }
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/docker/github-builder-test/actions/runs/18937328894/attempts/1"
+      },
+      "metadata": {
+        "invocationID": "7qg2yuux3iklv02ktbmbtwgeb",
+        "startedOn": "2025-10-30T10:19:52.868710505Z",
+        "finishedOn": "2025-10-30T10:19:57.635810119Z",
+        "buildkit_metadata": {
+          "source": {
+            "locations": {
+              "step0": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 1
+                        },
+                        "end": {
+                          "line": 1
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step1": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 3
+                        },
+                        "end": {
+                          "line": 3
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step2": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 7
+                        },
+                        "end": {
+                          "line": 7
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            "infos": [
+              {
+                "filename": "hello.Dockerfile",
+                "language": "Dockerfile",
+                "data": "RlJPTSBhbHBpbmUgQVMgYmFzZQpBUkcgVEFSR0VUUExBVEZPUk0KUlVOIGVjaG8gIkhlbGxvLCBXb3JsZCEgVGhpcyBpcyAke1RBUkdFVFBMQVRGT1JNfSIgPiAvaGVsbG8udHh0CkFSRyBCVUlMREtJVF9TQk9NX1NDQU5fU1RBR0U9dHJ1ZQoKRlJPTSBzY3JhdGNoCkNPUFkgLS1mcm9tPWJhc2UgL2hlbGxvLnR4dCAvCg==",
+                "llbDefinition": [
+                  {
+                    "id": "step0",
+                    "op": {
+                      "Op": {
+                        "source": {
+                          "identifier": "git://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+                          "attrs": {
+                            "git.authheadersecret": "GIT_AUTH_HEADER",
+                            "git.authtokensecret": "GIT_AUTH_TOKEN",
+                            "git.fullurl": "https://github.com/docker/github-builder-test.git"
+                          }
+                        }
+                      },
+                      "constraints": {}
+                    }
+                  },
+                  {
+                    "id": "step1",
+                    "op": {
+                      "Op": {}
+                    },
+                    "inputs": [
+                      "step0:0"
+                    ]
+                  }
+                ],
+                "digestMapping": {
+                  "sha256:47540f0959d81a7ff2fc9742b9ef0bb37d7eca99c13aa6df83b883d06e808ef2": "step0",
+                  "sha256:96933c546ff00debd500304305864192fcb51d348e8c41b6a6e1569a051e66ed": "step1"
+                }
+              }
+            ]
+          },
+          "layers": {
+            "step0:0": [
+              [
+                {
+                  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                  "digest": "sha256:2d35ebdb57d9971fea0cac1582aa78935adf8058b2cc32db163c98822e5dfa1b",
+                  "size": 3802452
+                }
+              ]
+            ]
+          }
+        },
+        "buildkit_completeness": {
+          "request": true,
+          "resolvedDependencies": true
+        }
+      }
+    }
+  }
+}
--- a/tests/.fixtures/sigstore/multi/linux_arm64/hello.txt
+++ b/tests/.fixtures/sigstore/multi/linux_arm64/hello.txt
@@ -0,0 +1 @@
+Hello, World! This is linux/arm64
--- a/tests/.fixtures/sigstore/multi/linux_arm64/provenance.json
+++ b/tests/.fixtures/sigstore/multi/linux_arm64/provenance.json
@@ -0,0 +1,462 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "hello.txt",
+      "digest": {
+        "sha256": "870e0065e68cbdeacbf9cec21b598bb579b0ef55bc48b65b71509667edb570bd"
+      }
+    }
+  ],
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md",
+      "resolvedDependencies": [
+        {
+          "uri": "pkg:docker/docker/buildkit-syft-scanner@stable-1",
+          "digest": {
+            "sha256": "e930c2697be77cb7271d316ecfa78768b5eac73de3b16018ed38eb0ea0b5a7cb"
+          }
+        },
+        {
+          "uri": "pkg:docker/alpine@latest?platform=linux%2Farm64",
+          "digest": {
+            "sha256": "4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+          }
+        },
+        {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          }
+        }
+      ],
+      "externalParameters": {
+        "configSource": {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          },
+          "path": "hello.Dockerfile"
+        },
+        "request": {
+          "frontend": "dockerfile.v0",
+          "secrets": [
+            {
+              "id": "GIT_AUTH_HEADER",
+              "optional": true
+            },
+            {
+              "id": "GIT_AUTH_TOKEN",
+              "optional": true
+            }
+          ]
+        }
+      },
+      "internalParameters": {
+        "buildConfig": {
+          "digestMapping": {
+            "sha256:69f88b22af1cbbe236f4b5d834dfe9c4adb9535c1c602f726fd90212c302a7da": "step0",
+            "sha256:98c0e3a8b1a38f5aa8db558b99aace8e7645a18b0e24d6807018146d21788ae2": "step2",
+            "sha256:a560219f1e0cfb232a9727b9bbf9d6735c0b2190f8e00364f844cfc82bd42479": "step1",
+            "sha256:c7edeef726371083a69f15a3565d6c62be55a91e820f251d9a965f8e36fe3e32": "step3"
+          },
+          "llbDefinition": [
+            {
+              "id": "step0",
+              "op": {
+                "Op": {
+                  "source": {
+                    "identifier": "docker-image://docker.io/library/alpine:latest@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "arm64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step1",
+              "inputs": [
+                "step0:0"
+              ],
+              "op": {
+                "Op": {
+                  "exec": {
+                    "meta": {
+                      "args": [
+                        "/bin/sh",
+                        "-c",
+                        "echo \"Hello, World! This is ${TARGETPLATFORM}\" \u003e /hello.txt"
+                      ],
+                      "cwd": "/",
+                      "env": [
+                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        "TARGETPLATFORM=linux/arm64"
+                      ],
+                      "removeMountStubsRecursive": true
+                    },
+                    "mounts": [
+                      {
+                        "dest": "/"
+                      }
+                    ]
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "arm64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step2",
+              "inputs": [
+                "step1:0"
+              ],
+              "op": {
+                "Op": {
+                  "file": {
+                    "actions": [
+                      {
+                        "Action": {
+                          "copy": {
+                            "allowEmptyWildcard": true,
+                            "allowWildcard": true,
+                            "createDestPath": true,
+                            "dest": "/",
+                            "dirCopyContents": true,
+                            "followSymlink": true,
+                            "mode": -1,
+                            "src": "/hello.txt",
+                            "timestamp": -1
+                          }
+                        },
+                        "input": -1,
+                        "output": 0,
+                        "secondaryInput": 0
+                      }
+                    ]
+                  }
+                },
+                "constraints": {}
+              }
+            },
+            {
+              "id": "step3",
+              "inputs": [
+                "step2:0"
+              ],
+              "op": {
+                "Op": {}
+              }
+            }
+          ]
+        },
+        "builderPlatform": "linux/amd64",
+        "github_actor": "crazy-max",
+        "github_actor_id": "1951866",
+        "github_event_name": "workflow_dispatch",
+        "github_event_payload": {
+          "enterprise": {
+            "avatar_url": "https://avatars.githubusercontent.com/b/19176?v=4",
+            "created_at": "2022-12-30T23:53:17Z",
+            "description": null,
+            "html_url": "https://github.com/enterprises/docker",
+            "id": 19176,
+            "name": "Docker",
+            "node_id": "E_kgDNSug",
+            "slug": "docker",
+            "updated_at": "2025-10-20T20:39:05Z",
+            "website_url": null
+          },
+          "inputs": null,
+          "organization": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+            "description": "Docker helps developers bring their ideas to life by conquering the complexity of app development.",
+            "events_url": "https://api.github.com/orgs/docker/events",
+            "hooks_url": "https://api.github.com/orgs/docker/hooks",
+            "id": 5429470,
+            "issues_url": "https://api.github.com/orgs/docker/issues",
+            "login": "docker",
+            "members_url": "https://api.github.com/orgs/docker/members{/member}",
+            "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+            "public_members_url": "https://api.github.com/orgs/docker/public_members{/member}",
+            "repos_url": "https://api.github.com/orgs/docker/repos",
+            "url": "https://api.github.com/orgs/docker"
+          },
+          "ref": "refs/heads/main",
+          "repository": {
+            "allow_forking": true,
+            "archive_url": "https://api.github.com/repos/docker/github-builder-test/{archive_format}{/ref}",
+            "archived": false,
+            "assignees_url": "https://api.github.com/repos/docker/github-builder-test/assignees{/user}",
+            "blobs_url": "https://api.github.com/repos/docker/github-builder-test/git/blobs{/sha}",
+            "branches_url": "https://api.github.com/repos/docker/github-builder-test/branches{/branch}",
+            "clone_url": "https://github.com/docker/github-builder-test.git",
+            "collaborators_url": "https://api.github.com/repos/docker/github-builder-test/collaborators{/collaborator}",
+            "comments_url": "https://api.github.com/repos/docker/github-builder-test/comments{/number}",
+            "commits_url": "https://api.github.com/repos/docker/github-builder-test/commits{/sha}",
+            "compare_url": "https://api.github.com/repos/docker/github-builder-test/compare/{base}...{head}",
+            "contents_url": "https://api.github.com/repos/docker/github-builder-test/contents/{+path}",
+            "contributors_url": "https://api.github.com/repos/docker/github-builder-test/contributors",
+            "created_at": "2025-08-19T08:08:29Z",
+            "custom_properties": {},
+            "default_branch": "main",
+            "deployments_url": "https://api.github.com/repos/docker/github-builder-test/deployments",
+            "description": "Test repo for https://github.com/docker/github-builder-experimental",
+            "disabled": false,
+            "downloads_url": "https://api.github.com/repos/docker/github-builder-test/downloads",
+            "events_url": "https://api.github.com/repos/docker/github-builder-test/events",
+            "fork": false,
+            "forks": 0,
+            "forks_count": 0,
+            "forks_url": "https://api.github.com/repos/docker/github-builder-test/forks",
+            "full_name": "docker/github-builder-test",
+            "git_commits_url": "https://api.github.com/repos/docker/github-builder-test/git/commits{/sha}",
+            "git_refs_url": "https://api.github.com/repos/docker/github-builder-test/git/refs{/sha}",
+            "git_tags_url": "https://api.github.com/repos/docker/github-builder-test/git/tags{/sha}",
+            "git_url": "git://github.com/docker/github-builder-test.git",
+            "has_discussions": false,
+            "has_downloads": true,
+            "has_issues": false,
+            "has_pages": false,
+            "has_projects": false,
+            "has_wiki": false,
+            "homepage": null,
+            "hooks_url": "https://api.github.com/repos/docker/github-builder-test/hooks",
+            "html_url": "https://github.com/docker/github-builder-test",
+            "id": 1040594287,
+            "is_template": false,
+            "issue_comment_url": "https://api.github.com/repos/docker/github-builder-test/issues/comments{/number}",
+            "issue_events_url": "https://api.github.com/repos/docker/github-builder-test/issues/events{/number}",
+            "issues_url": "https://api.github.com/repos/docker/github-builder-test/issues{/number}",
+            "keys_url": "https://api.github.com/repos/docker/github-builder-test/keys{/key_id}",
+            "labels_url": "https://api.github.com/repos/docker/github-builder-test/labels{/name}",
+            "language": "Dockerfile",
+            "languages_url": "https://api.github.com/repos/docker/github-builder-test/languages",
+            "license": null,
+            "merges_url": "https://api.github.com/repos/docker/github-builder-test/merges",
+            "milestones_url": "https://api.github.com/repos/docker/github-builder-test/milestones{/number}",
+            "mirror_url": null,
+            "name": "github-builder-test",
+            "node_id": "R_kgDOPgY1bw",
+            "notifications_url": "https://api.github.com/repos/docker/github-builder-test/notifications{?since,all,participating}",
+            "open_issues": 0,
+            "open_issues_count": 0,
+            "owner": {
+              "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+              "events_url": "https://api.github.com/users/docker/events{/privacy}",
+              "followers_url": "https://api.github.com/users/docker/followers",
+              "following_url": "https://api.github.com/users/docker/following{/other_user}",
+              "gists_url": "https://api.github.com/users/docker/gists{/gist_id}",
+              "gravatar_id": "",
+              "html_url": "https://github.com/docker",
+              "id": 5429470,
+              "login": "docker",
+              "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+              "organizations_url": "https://api.github.com/users/docker/orgs",
+              "received_events_url": "https://api.github.com/users/docker/received_events",
+              "repos_url": "https://api.github.com/users/docker/repos",
+              "site_admin": false,
+              "starred_url": "https://api.github.com/users/docker/starred{/owner}{/repo}",
+              "subscriptions_url": "https://api.github.com/users/docker/subscriptions",
+              "type": "Organization",
+              "url": "https://api.github.com/users/docker",
+              "user_view_type": "public"
+            },
+            "private": true,
+            "pulls_url": "https://api.github.com/repos/docker/github-builder-test/pulls{/number}",
+            "pushed_at": "2025-10-30T10:04:10Z",
+            "releases_url": "https://api.github.com/repos/docker/github-builder-test/releases{/id}",
+            "size": 25,
+            "ssh_url": "git@github.com:docker/github-builder-test.git",
+            "stargazers_count": 0,
+            "stargazers_url": "https://api.github.com/repos/docker/github-builder-test/stargazers",
+            "statuses_url": "https://api.github.com/repos/docker/github-builder-test/statuses/{sha}",
+            "subscribers_url": "https://api.github.com/repos/docker/github-builder-test/subscribers",
+            "subscription_url": "https://api.github.com/repos/docker/github-builder-test/subscription",
+            "svn_url": "https://github.com/docker/github-builder-test",
+            "tags_url": "https://api.github.com/repos/docker/github-builder-test/tags",
+            "teams_url": "https://api.github.com/repos/docker/github-builder-test/teams",
+            "topics": [],
+            "trees_url": "https://api.github.com/repos/docker/github-builder-test/git/trees{/sha}",
+            "updated_at": "2025-10-30T10:04:14Z",
+            "url": "https://api.github.com/repos/docker/github-builder-test",
+            "visibility": "internal",
+            "watchers": 0,
+            "watchers_count": 0,
+            "web_commit_signoff_required": false
+          },
+          "sender": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/1951866?v=4",
+            "events_url": "https://api.github.com/users/crazy-max/events{/privacy}",
+            "followers_url": "https://api.github.com/users/crazy-max/followers",
+            "following_url": "https://api.github.com/users/crazy-max/following{/other_user}",
+            "gists_url": "https://api.github.com/users/crazy-max/gists{/gist_id}",
+            "gravatar_id": "",
+            "html_url": "https://github.com/crazy-max",
+            "id": 1951866,
+            "login": "crazy-max",
+            "node_id": "MDQ6VXNlcjE5NTE4NjY=",
+            "organizations_url": "https://api.github.com/users/crazy-max/orgs",
+            "received_events_url": "https://api.github.com/users/crazy-max/received_events",
+            "repos_url": "https://api.github.com/users/crazy-max/repos",
+            "site_admin": false,
+            "starred_url": "https://api.github.com/users/crazy-max/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/crazy-max/subscriptions",
+            "type": "User",
+            "url": "https://api.github.com/users/crazy-max",
+            "user_view_type": "public"
+          },
+          "workflow": ".github/workflows/ci.yml"
+        },
+        "github_job": "build",
+        "github_ref": "refs/heads/main",
+        "github_ref_name": "main",
+        "github_ref_protected": "false",
+        "github_ref_type": "branch",
+        "github_repository": "docker/github-builder-test",
+        "github_repository_id": "1040594287",
+        "github_repository_owner": "docker",
+        "github_repository_owner_id": "5429470",
+        "github_run_attempt": "1",
+        "github_run_id": "18937328894",
+        "github_run_number": "183",
+        "github_runner_arch": "X64",
+        "github_runner_environment": "github-hosted",
+        "github_runner_image_os": "ubuntu24",
+        "github_runner_image_version": "20250929.60.1",
+        "github_runner_name": "GitHub Actions 1002376925",
+        "github_runner_os": "Linux",
+        "github_runner_tracking_id": "github_7c0a7521-2999-41e5-af30-b7f0681f204f",
+        "github_server_url": "https://github.com",
+        "github_triggering_actor": "crazy-max",
+        "github_workflow": "ci",
+        "github_workflow_ref": "docker/github-builder-test/.github/workflows/ci.yml@refs/heads/main",
+        "github_workflow_sha": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+      }
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/docker/github-builder-test/actions/runs/18937328894/attempts/1"
+      },
+      "metadata": {
+        "invocationID": "7qg2yuux3iklv02ktbmbtwgeb",
+        "startedOn": "2025-10-30T10:19:52.868710505Z",
+        "finishedOn": "2025-10-30T10:19:57.635810119Z",
+        "buildkit_metadata": {
+          "source": {
+            "locations": {
+              "step0": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 1
+                        },
+                        "end": {
+                          "line": 1
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step1": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 3
+                        },
+                        "end": {
+                          "line": 3
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step2": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 7
+                        },
+                        "end": {
+                          "line": 7
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            "infos": [
+              {
+                "filename": "hello.Dockerfile",
+                "language": "Dockerfile",
+                "data": "RlJPTSBhbHBpbmUgQVMgYmFzZQpBUkcgVEFSR0VUUExBVEZPUk0KUlVOIGVjaG8gIkhlbGxvLCBXb3JsZCEgVGhpcyBpcyAke1RBUkdFVFBMQVRGT1JNfSIgPiAvaGVsbG8udHh0CkFSRyBCVUlMREtJVF9TQk9NX1NDQU5fU1RBR0U9dHJ1ZQoKRlJPTSBzY3JhdGNoCkNPUFkgLS1mcm9tPWJhc2UgL2hlbGxvLnR4dCAvCg==",
+                "llbDefinition": [
+                  {
+                    "id": "step0",
+                    "op": {
+                      "Op": {
+                        "source": {
+                          "identifier": "git://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+                          "attrs": {
+                            "git.authheadersecret": "GIT_AUTH_HEADER",
+                            "git.authtokensecret": "GIT_AUTH_TOKEN",
+                            "git.fullurl": "https://github.com/docker/github-builder-test.git"
+                          }
+                        }
+                      },
+                      "constraints": {}
+                    }
+                  },
+                  {
+                    "id": "step1",
+                    "op": {
+                      "Op": {}
+                    },
+                    "inputs": [
+                      "step0:0"
+                    ]
+                  }
+                ],
+                "digestMapping": {
+                  "sha256:47540f0959d81a7ff2fc9742b9ef0bb37d7eca99c13aa6df83b883d06e808ef2": "step0",
+                  "sha256:96933c546ff00debd500304305864192fcb51d348e8c41b6a6e1569a051e66ed": "step1"
+                }
+              }
+            ]
+          },
+          "layers": {
+            "step0:0": [
+              [
+                {
+                  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                  "digest": "sha256:6b59a28fa20117e6048ad0616b8d8c901877ef15ff4c7f18db04e4f01f43bc39",
+                  "size": 4138069
+                }
+              ]
+            ]
+          }
+        },
+        "buildkit_completeness": {
+          "request": true,
+          "resolvedDependencies": true
+        }
+      }
+    }
+  }
+}
--- a/tests/.fixtures/sigstore/single/hello.txt
+++ b/tests/.fixtures/sigstore/single/hello.txt
@@ -0,0 +1 @@
+Hello, World! This is linux/amd64
--- a/tests/.fixtures/sigstore/single/provenance.json
+++ b/tests/.fixtures/sigstore/single/provenance.json
@@ -0,0 +1,462 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "hello.txt",
+      "digest": {
+        "sha256": "1b37929e66644beb58b3d28d44fba0d82aa90cab03c55a492adb81fe6e833ec8"
+      }
+    }
+  ],
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md",
+      "resolvedDependencies": [
+        {
+          "uri": "pkg:docker/docker/buildkit-syft-scanner@stable-1",
+          "digest": {
+            "sha256": "e930c2697be77cb7271d316ecfa78768b5eac73de3b16018ed38eb0ea0b5a7cb"
+          }
+        },
+        {
+          "uri": "pkg:docker/alpine@latest?platform=linux%2Famd64",
+          "digest": {
+            "sha256": "4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+          }
+        },
+        {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          }
+        }
+      ],
+      "externalParameters": {
+        "configSource": {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          },
+          "path": "hello.Dockerfile"
+        },
+        "request": {
+          "frontend": "dockerfile.v0",
+          "secrets": [
+            {
+              "id": "GIT_AUTH_HEADER",
+              "optional": true
+            },
+            {
+              "id": "GIT_AUTH_TOKEN",
+              "optional": true
+            }
+          ]
+        }
+      },
+      "internalParameters": {
+        "buildConfig": {
+          "digestMapping": {
+            "sha256:23dcbc3cce701a8a9bbb1e33f2ea88304527a4a935c89c4564af698095463ac2": "step3",
+            "sha256:3192c1bd53f90cca959db778dcee30edc9a79f8cd3f9a2c54adc4606507fd3b6": "step0",
+            "sha256:7f1c9e959980ea3e2cf4af8ef97b6c3797a0926752b436bff11474e436defe7f": "step1",
+            "sha256:c8737331fb8e5f5bcb6b22320012d975057514982c788e63db13332a4219b984": "step2"
+          },
+          "llbDefinition": [
+            {
+              "id": "step0",
+              "op": {
+                "Op": {
+                  "source": {
+                    "identifier": "docker-image://docker.io/library/alpine:latest@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step1",
+              "inputs": [
+                "step0:0"
+              ],
+              "op": {
+                "Op": {
+                  "exec": {
+                    "meta": {
+                      "args": [
+                        "/bin/sh",
+                        "-c",
+                        "echo \"Hello, World! This is ${TARGETPLATFORM}\" \u003e /hello.txt"
+                      ],
+                      "cwd": "/",
+                      "env": [
+                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        "TARGETPLATFORM=linux/amd64"
+                      ],
+                      "removeMountStubsRecursive": true
+                    },
+                    "mounts": [
+                      {
+                        "dest": "/"
+                      }
+                    ]
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step2",
+              "inputs": [
+                "step1:0"
+              ],
+              "op": {
+                "Op": {
+                  "file": {
+                    "actions": [
+                      {
+                        "Action": {
+                          "copy": {
+                            "allowEmptyWildcard": true,
+                            "allowWildcard": true,
+                            "createDestPath": true,
+                            "dest": "/",
+                            "dirCopyContents": true,
+                            "followSymlink": true,
+                            "mode": -1,
+                            "src": "/hello.txt",
+                            "timestamp": -1
+                          }
+                        },
+                        "input": -1,
+                        "output": 0,
+                        "secondaryInput": 0
+                      }
+                    ]
+                  }
+                },
+                "constraints": {}
+              }
+            },
+            {
+              "id": "step3",
+              "inputs": [
+                "step2:0"
+              ],
+              "op": {
+                "Op": {}
+              }
+            }
+          ]
+        },
+        "builderPlatform": "linux/amd64",
+        "github_actor": "crazy-max",
+        "github_actor_id": "1951866",
+        "github_event_name": "workflow_dispatch",
+        "github_event_payload": {
+          "enterprise": {
+            "avatar_url": "https://avatars.githubusercontent.com/b/19176?v=4",
+            "created_at": "2022-12-30T23:53:17Z",
+            "description": null,
+            "html_url": "https://github.com/enterprises/docker",
+            "id": 19176,
+            "name": "Docker",
+            "node_id": "E_kgDNSug",
+            "slug": "docker",
+            "updated_at": "2025-10-20T20:39:05Z",
+            "website_url": null
+          },
+          "inputs": null,
+          "organization": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+            "description": "Docker helps developers bring their ideas to life by conquering the complexity of app development.",
+            "events_url": "https://api.github.com/orgs/docker/events",
+            "hooks_url": "https://api.github.com/orgs/docker/hooks",
+            "id": 5429470,
+            "issues_url": "https://api.github.com/orgs/docker/issues",
+            "login": "docker",
+            "members_url": "https://api.github.com/orgs/docker/members{/member}",
+            "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+            "public_members_url": "https://api.github.com/orgs/docker/public_members{/member}",
+            "repos_url": "https://api.github.com/orgs/docker/repos",
+            "url": "https://api.github.com/orgs/docker"
+          },
+          "ref": "refs/heads/main",
+          "repository": {
+            "allow_forking": true,
+            "archive_url": "https://api.github.com/repos/docker/github-builder-test/{archive_format}{/ref}",
+            "archived": false,
+            "assignees_url": "https://api.github.com/repos/docker/github-builder-test/assignees{/user}",
+            "blobs_url": "https://api.github.com/repos/docker/github-builder-test/git/blobs{/sha}",
+            "branches_url": "https://api.github.com/repos/docker/github-builder-test/branches{/branch}",
+            "clone_url": "https://github.com/docker/github-builder-test.git",
+            "collaborators_url": "https://api.github.com/repos/docker/github-builder-test/collaborators{/collaborator}",
+            "comments_url": "https://api.github.com/repos/docker/github-builder-test/comments{/number}",
+            "commits_url": "https://api.github.com/repos/docker/github-builder-test/commits{/sha}",
+            "compare_url": "https://api.github.com/repos/docker/github-builder-test/compare/{base}...{head}",
+            "contents_url": "https://api.github.com/repos/docker/github-builder-test/contents/{+path}",
+            "contributors_url": "https://api.github.com/repos/docker/github-builder-test/contributors",
+            "created_at": "2025-08-19T08:08:29Z",
+            "custom_properties": {},
+            "default_branch": "main",
+            "deployments_url": "https://api.github.com/repos/docker/github-builder-test/deployments",
+            "description": "Test repo for https://github.com/docker/github-builder-experimental",
+            "disabled": false,
+            "downloads_url": "https://api.github.com/repos/docker/github-builder-test/downloads",
+            "events_url": "https://api.github.com/repos/docker/github-builder-test/events",
+            "fork": false,
+            "forks": 0,
+            "forks_count": 0,
+            "forks_url": "https://api.github.com/repos/docker/github-builder-test/forks",
+            "full_name": "docker/github-builder-test",
+            "git_commits_url": "https://api.github.com/repos/docker/github-builder-test/git/commits{/sha}",
+            "git_refs_url": "https://api.github.com/repos/docker/github-builder-test/git/refs{/sha}",
+            "git_tags_url": "https://api.github.com/repos/docker/github-builder-test/git/tags{/sha}",
+            "git_url": "git://github.com/docker/github-builder-test.git",
+            "has_discussions": false,
+            "has_downloads": true,
+            "has_issues": false,
+            "has_pages": false,
+            "has_projects": false,
+            "has_wiki": false,
+            "homepage": null,
+            "hooks_url": "https://api.github.com/repos/docker/github-builder-test/hooks",
+            "html_url": "https://github.com/docker/github-builder-test",
+            "id": 1040594287,
+            "is_template": false,
+            "issue_comment_url": "https://api.github.com/repos/docker/github-builder-test/issues/comments{/number}",
+            "issue_events_url": "https://api.github.com/repos/docker/github-builder-test/issues/events{/number}",
+            "issues_url": "https://api.github.com/repos/docker/github-builder-test/issues{/number}",
+            "keys_url": "https://api.github.com/repos/docker/github-builder-test/keys{/key_id}",
+            "labels_url": "https://api.github.com/repos/docker/github-builder-test/labels{/name}",
+            "language": "Dockerfile",
+            "languages_url": "https://api.github.com/repos/docker/github-builder-test/languages",
+            "license": null,
+            "merges_url": "https://api.github.com/repos/docker/github-builder-test/merges",
+            "milestones_url": "https://api.github.com/repos/docker/github-builder-test/milestones{/number}",
+            "mirror_url": null,
+            "name": "github-builder-test",
+            "node_id": "R_kgDOPgY1bw",
+            "notifications_url": "https://api.github.com/repos/docker/github-builder-test/notifications{?since,all,participating}",
+            "open_issues": 0,
+            "open_issues_count": 0,
+            "owner": {
+              "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+              "events_url": "https://api.github.com/users/docker/events{/privacy}",
+              "followers_url": "https://api.github.com/users/docker/followers",
+              "following_url": "https://api.github.com/users/docker/following{/other_user}",
+              "gists_url": "https://api.github.com/users/docker/gists{/gist_id}",
+              "gravatar_id": "",
+              "html_url": "https://github.com/docker",
+              "id": 5429470,
+              "login": "docker",
+              "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+              "organizations_url": "https://api.github.com/users/docker/orgs",
+              "received_events_url": "https://api.github.com/users/docker/received_events",
+              "repos_url": "https://api.github.com/users/docker/repos",
+              "site_admin": false,
+              "starred_url": "https://api.github.com/users/docker/starred{/owner}{/repo}",
+              "subscriptions_url": "https://api.github.com/users/docker/subscriptions",
+              "type": "Organization",
+              "url": "https://api.github.com/users/docker",
+              "user_view_type": "public"
+            },
+            "private": true,
+            "pulls_url": "https://api.github.com/repos/docker/github-builder-test/pulls{/number}",
+            "pushed_at": "2025-10-30T10:04:10Z",
+            "releases_url": "https://api.github.com/repos/docker/github-builder-test/releases{/id}",
+            "size": 25,
+            "ssh_url": "git@github.com:docker/github-builder-test.git",
+            "stargazers_count": 0,
+            "stargazers_url": "https://api.github.com/repos/docker/github-builder-test/stargazers",
+            "statuses_url": "https://api.github.com/repos/docker/github-builder-test/statuses/{sha}",
+            "subscribers_url": "https://api.github.com/repos/docker/github-builder-test/subscribers",
+            "subscription_url": "https://api.github.com/repos/docker/github-builder-test/subscription",
+            "svn_url": "https://github.com/docker/github-builder-test",
+            "tags_url": "https://api.github.com/repos/docker/github-builder-test/tags",
+            "teams_url": "https://api.github.com/repos/docker/github-builder-test/teams",
+            "topics": [],
+            "trees_url": "https://api.github.com/repos/docker/github-builder-test/git/trees{/sha}",
+            "updated_at": "2025-10-30T10:04:14Z",
+            "url": "https://api.github.com/repos/docker/github-builder-test",
+            "visibility": "internal",
+            "watchers": 0,
+            "watchers_count": 0,
+            "web_commit_signoff_required": false
+          },
+          "sender": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/1951866?v=4",
+            "events_url": "https://api.github.com/users/crazy-max/events{/privacy}",
+            "followers_url": "https://api.github.com/users/crazy-max/followers",
+            "following_url": "https://api.github.com/users/crazy-max/following{/other_user}",
+            "gists_url": "https://api.github.com/users/crazy-max/gists{/gist_id}",
+            "gravatar_id": "",
+            "html_url": "https://github.com/crazy-max",
+            "id": 1951866,
+            "login": "crazy-max",
+            "node_id": "MDQ6VXNlcjE5NTE4NjY=",
+            "organizations_url": "https://api.github.com/users/crazy-max/orgs",
+            "received_events_url": "https://api.github.com/users/crazy-max/received_events",
+            "repos_url": "https://api.github.com/users/crazy-max/repos",
+            "site_admin": false,
+            "starred_url": "https://api.github.com/users/crazy-max/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/crazy-max/subscriptions",
+            "type": "User",
+            "url": "https://api.github.com/users/crazy-max",
+            "user_view_type": "public"
+          },
+          "workflow": ".github/workflows/ci.yml"
+        },
+        "github_job": "build",
+        "github_ref": "refs/heads/main",
+        "github_ref_name": "main",
+        "github_ref_protected": "false",
+        "github_ref_type": "branch",
+        "github_repository": "docker/github-builder-test",
+        "github_repository_id": "1040594287",
+        "github_repository_owner": "docker",
+        "github_repository_owner_id": "5429470",
+        "github_run_attempt": "1",
+        "github_run_id": "18937328894",
+        "github_run_number": "183",
+        "github_runner_arch": "X64",
+        "github_runner_environment": "github-hosted",
+        "github_runner_image_os": "ubuntu24",
+        "github_runner_image_version": "20250929.60.1",
+        "github_runner_name": "GitHub Actions 1002376925",
+        "github_runner_os": "Linux",
+        "github_runner_tracking_id": "github_7c0a7521-2999-41e5-af30-b7f0681f204f",
+        "github_server_url": "https://github.com",
+        "github_triggering_actor": "crazy-max",
+        "github_workflow": "ci",
+        "github_workflow_ref": "docker/github-builder-test/.github/workflows/ci.yml@refs/heads/main",
+        "github_workflow_sha": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+      }
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/docker/github-builder-test/actions/runs/18937328894/attempts/1"
+      },
+      "metadata": {
+        "invocationID": "7qg2yuux3iklv02ktbmbtwgeb",
+        "startedOn": "2025-10-30T10:19:52.868710505Z",
+        "finishedOn": "2025-10-30T10:19:57.635810119Z",
+        "buildkit_metadata": {
+          "source": {
+            "locations": {
+              "step0": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 1
+                        },
+                        "end": {
+                          "line": 1
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step1": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 3
+                        },
+                        "end": {
+                          "line": 3
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step2": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 7
+                        },
+                        "end": {
+                          "line": 7
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            "infos": [
+              {
+                "filename": "hello.Dockerfile",
+                "language": "Dockerfile",
+                "data": "RlJPTSBhbHBpbmUgQVMgYmFzZQpBUkcgVEFSR0VUUExBVEZPUk0KUlVOIGVjaG8gIkhlbGxvLCBXb3JsZCEgVGhpcyBpcyAke1RBUkdFVFBMQVRGT1JNfSIgPiAvaGVsbG8udHh0CkFSRyBCVUlMREtJVF9TQk9NX1NDQU5fU1RBR0U9dHJ1ZQoKRlJPTSBzY3JhdGNoCkNPUFkgLS1mcm9tPWJhc2UgL2hlbGxvLnR4dCAvCg==",
+                "llbDefinition": [
+                  {
+                    "id": "step0",
+                    "op": {
+                      "Op": {
+                        "source": {
+                          "identifier": "git://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+                          "attrs": {
+                            "git.authheadersecret": "GIT_AUTH_HEADER",
+                            "git.authtokensecret": "GIT_AUTH_TOKEN",
+                            "git.fullurl": "https://github.com/docker/github-builder-test.git"
+                          }
+                        }
+                      },
+                      "constraints": {}
+                    }
+                  },
+                  {
+                    "id": "step1",
+                    "op": {
+                      "Op": {}
+                    },
+                    "inputs": [
+                      "step0:0"
+                    ]
+                  }
+                ],
+                "digestMapping": {
+                  "sha256:47540f0959d81a7ff2fc9742b9ef0bb37d7eca99c13aa6df83b883d06e808ef2": "step0",
+                  "sha256:96933c546ff00debd500304305864192fcb51d348e8c41b6a6e1569a051e66ed": "step1"
+                }
+              }
+            ]
+          },
+          "layers": {
+            "step0:0": [
+              [
+                {
+                  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                  "digest": "sha256:2d35ebdb57d9971fea0cac1582aa78935adf8058b2cc32db163c98822e5dfa1b",
+                  "size": 3802452
+                }
+              ]
+            ]
+          }
+        },
+        "buildkit_completeness": {
+          "request": true,
+          "resolvedDependencies": true
+        }
+      }
+    }
+  }
+}
--- a/tests/buildx/bake.test.ts
+++ b/tests/buildx/bake.test.ts
@@ -485,3 +485,113 @@ describe('hasGitAuthTokenSecret', () => {
    expect(Bake.hasGitAuthTokenSecret(def)).toEqual(expected);
  });
 });
+
+describe('hasProvenanceAttestation', () => {
+  // prettier-ignore
+  test.each([
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      false
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              },
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ]
+  ])('given %o returns %p', async (def: BakeDefinition, expected: boolean) => {
+    expect(Bake.hasProvenanceAttestation(def)).toEqual(expected);
+  });
+});
+
+describe('hasSBOMAttestation', () => {
+  // prettier-ignore
+  test.each([
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      false
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              },
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ]
+  ])('given %o returns %p', async (def: BakeDefinition, expected: boolean) => {
+    expect(Bake.hasSBOMAttestation(def)).toEqual(expected);
+  });
+});
--- a/tests/buildx/builder.test.ts
+++ b/tests/buildx/builder.test.ts
@@ -49,7 +49,6 @@ describe('exists', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    const builder = new Builder();
    await builder.exists('foo');
-    // eslint-disable-next-line jest/no-standalone-expect
    expect(execSpy).toHaveBeenCalledWith(`docker`, ['buildx', 'inspect', 'foo'], {
      silent: true,
      ignoreReturnCode: true
--- a/tests/buildx/buildx.test.ts
+++ b/tests/buildx/buildx.test.ts
@@ -91,7 +91,6 @@ describe('isAvailable', () => {
      standalone: false
    });
    await buildx.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
    expect(execSpy).toHaveBeenCalledWith(`docker`, ['buildx'], {
      silent: true,
      ignoreReturnCode: true
@@ -103,7 +102,6 @@ describe('isAvailable', () => {
      standalone: true
    });
    await buildx.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
    expect(execSpy).toHaveBeenCalledWith(`buildx`, [], {
      silent: true,
      ignoreReturnCode: true
--- a/tests/buildx/imagetools.test.itg.ts
+++ b/tests/buildx/imagetools.test.itg.ts
@@ -19,7 +19,10 @@ import * as fs from 'fs';
 import * as path from 'path';

 import {ImageTools} from '../../src/buildx/imagetools';
+
+import {Manifest as ImageToolsManifest} from '../../src/types/buildx/imagetools';
 import {Image} from '../../src/types/oci/config';
+import {Descriptor} from '../../src/types/oci/descriptor';

 const fixturesDir = path.join(__dirname, '..', '.fixtures');

@@ -37,3 +40,39 @@ maybe('inspectImage', () => {
    expect(image).toEqual(expectedImage);
  });
 });
+
+maybe('inspectManifest', () => {
+  it('inspect descriptor', async () => {
+    const manifest = await new ImageTools().inspectManifest('moby/buildkit:latest@sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc');
+    const expectedManifest = <Descriptor>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-03.json'), {encoding: 'utf-8'}).trim());
+    expect(manifest).toEqual(expectedManifest);
+  });
+  it('inspect index', async () => {
+    const manifest = await new ImageTools().inspectManifest('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6');
+    const expectedManifest = <ImageToolsManifest>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-04.json'), {encoding: 'utf-8'}).trim());
+    expect(manifest).toEqual(expectedManifest);
+  });
+});
+
+maybe('attestationDescriptors', () => {
+  it('returns buildkit attestations descriptors', async () => {
+    const attestations = await new ImageTools().attestationDescriptors('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6');
+    const expectedAttestations = <Array<Descriptor>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-05.json'), {encoding: 'utf-8'}).trim());
+    expect(attestations).toEqual(expectedAttestations);
+  });
+});
+
+maybe('attestationDigests', () => {
+  it('returns buildkit attestations digests', async () => {
+    const digests = await new ImageTools().attestationDigests('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6');
+    // prettier-ignore
+    expect(digests).toEqual([
+      'sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2',
+      'sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03',
+      'sha256:241b7159129d53923c89708bcc052b3398086a826519896be2f025545916e43e',
+      'sha256:97f4a222a7992dba6dc1a43991d0cca1fcffdc25593033c6a3a7ff14c8651cbf',
+      'sha256:aa933713d8094b2708120e889acb6f7153dee4e0f3298ccd3e37a584cd0c260d',
+      'sha256:d95ca72d4f2a6bc416d4b2f3003b2af9d5f4dea99acec6ad3ab0c2082000a98c'
+    ]);
+  });
+});
--- a/tests/buildx/install.test.ts
+++ b/tests/buildx/install.test.ts
@@ -94,7 +94,6 @@ describe('download', () => {
 });

 describe('build', () => {
-  // eslint-disable-next-line jest/no-disabled-tests
  it.skip('builds refs/pull/648/head', async () => {
    const install = new Install();
    const toolPath = await install.build('https://github.com/docker/buildx.git#refs/pull/648/head');
@@ -103,7 +102,6 @@ describe('build', () => {
    expect(fs.existsSync(buildxBin)).toBe(true);
  }, 100000);

-  // eslint-disable-next-line jest/no-disabled-tests
  it.skip('builds 67bd6f4dc82a9cd96f34133dab3f6f7af803bb14', async () => {
    const install = new Install();
    const toolPath = await install.build('https://github.com/docker/buildx.git#67bd6f4dc82a9cd96f34133dab3f6f7af803bb14');
@@ -119,7 +117,12 @@ describe('getDownloadVersion', () => {
    expect(version.key).toEqual('official');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/docker/buildx/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-releases.json'
+    });
  });

  it('returns official v0.10.1 download version', async () => {
@@ -127,7 +130,12 @@ describe('getDownloadVersion', () => {
    expect(version.key).toEqual('official');
    expect(version.version).toEqual('v0.10.1');
    expect(version.downloadURL).toEqual('https://github.com/docker/buildx/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-releases.json'
+    });
  });

  it('returns cloud latest download version', async () => {
@@ -135,7 +143,12 @@ describe('getDownloadVersion', () => {
    expect(version.key).toEqual('cloud');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-lab-releases.json'
+    });
  });

  it('returns cloud v0.11.2-desktop.2 download version', async () => {
@@ -143,7 +156,12 @@ describe('getDownloadVersion', () => {
    expect(version.key).toEqual('cloud');
    expect(version.version).toEqual('v0.11.2-desktop.2');
    expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-lab-releases.json'
+    });
  });

  it('returns cloud for lab version', async () => {
@@ -151,7 +169,12 @@ describe('getDownloadVersion', () => {
    expect(version.key).toEqual('cloud');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-lab-releases.json'
+    });
  });

  it('unknown repo', async () => {
@@ -187,6 +210,6 @@ describe('getRelease', () => {

  it('unknown release', async () => {
    const version = await Install.getDownloadVersion('foo');
-    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Buildx release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json'));
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Buildx release foo in releases JSON'));
  });
 });
--- a/tests/compose/compose.test.ts
+++ b/tests/compose/compose.test.ts
@@ -49,7 +49,6 @@ describe('isAvailable', () => {
      standalone: false
    });
    await compose.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
    expect(execSpy).toHaveBeenCalledWith(`docker`, ['compose'], {
      silent: true,
      ignoreReturnCode: true
@@ -61,7 +60,6 @@ describe('isAvailable', () => {
      standalone: true
    });
    await compose.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
    expect(execSpy).toHaveBeenCalledWith(`compose`, [], {
      silent: true,
      ignoreReturnCode: true
--- a/tests/compose/install.test.ts
+++ b/tests/compose/install.test.ts
@@ -99,28 +99,48 @@ describe('getDownloadVersion', () => {
    expect(version.key).toEqual('official');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/docker/compose/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-releases.json'
+    });
  });
  it('returns official v2.24.3 download version', async () => {
    const version = await Install.getDownloadVersion('v2.24.3');
    expect(version.key).toEqual('official');
    expect(version.version).toEqual('v2.24.3');
    expect(version.downloadURL).toEqual('https://github.com/docker/compose/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-releases.json'
+    });
  });
  it('returns cloud latest download version', async () => {
    const version = await Install.getDownloadVersion('cloud:latest');
    expect(version.key).toEqual('cloud');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/docker/compose-desktop/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-lab-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-lab-releases.json'
+    });
  });
  it('returns cloud v2.27.1-desktop.1 download version', async () => {
    const version = await Install.getDownloadVersion('cloud:v2.27.1-desktop.1');
    expect(version.key).toEqual('cloud');
    expect(version.version).toEqual('v2.27.1-desktop.1');
    expect(version.downloadURL).toEqual('https://github.com/docker/compose-desktop/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-lab-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-lab-releases.json'
+    });
  });
  it('unknown repo', async () => {
    await expect(Install.getDownloadVersion('foo:bar')).rejects.toThrow(new Error('Cannot find compose version for foo:bar'));
@@ -152,6 +172,6 @@ describe('getRelease', () => {
  });
  it('unknown release', async () => {
    const version = await Install.getDownloadVersion('foo');
-    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Compose release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json'));
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Compose release foo in releases JSON'));
  });
 });
--- a/tests/cosign/cosign.test.ts
+++ b/tests/cosign/cosign.test.ts
@@ -0,0 +1,89 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test} from '@jest/globals';
+import fs from 'fs';
+import path from 'path';
+import * as semver from 'semver';
+
+import {Exec} from '../../src/exec';
+import {Cosign} from '../../src/cosign/cosign';
+
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
+
+describe('isAvailable', () => {
+  it('checks Cosign is available', async () => {
+    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const cosign = new Cosign();
+    await cosign.isAvailable();
+    expect(execSpy).toHaveBeenCalledWith(`cosign`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('prints Cosign version', async () => {
+    const execSpy = jest.spyOn(Exec, 'exec');
+    const cosign = new Cosign();
+    await cosign.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`cosign`, ['version', '--json'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const cosign = new Cosign();
+    expect(semver.valid(await cosign.version())).not.toBeUndefined();
+  });
+});
+
+describe('versionSatisfies', () => {
+  test.each([
+    ['v0.4.1', '>=0.3.2', true],
+    ['v0.8.0', '>0.6.0', true],
+    ['v0.8.0', '<0.3.0', false]
+  ])('given %p', async (version, range, expected) => {
+    const cosign = new Cosign();
+    expect(await cosign.versionSatisfies(range, version)).toBe(expected);
+  });
+});
+
+describe('parseCommandOutput', () => {
+  // prettier-ignore
+  test.each([
+    [path.join(fixturesDir, 'cosign', 'sign-output1.txt')],
+    [path.join(fixturesDir, 'cosign', 'sign-output2.txt')],
+    [path.join(fixturesDir, 'cosign', 'sign-output3.txt')],
+  ])('parsing %p', async (fixturePath: string) => {
+    const signResult = Cosign.parseCommandOutput(fs.readFileSync(fixturePath, 'utf-8'));
+    expect(signResult).toBeDefined();
+    expect(signResult.bundle).toBeDefined();
+  });
+
+  // prettier-ignore
+  test.each([
+    [path.join(fixturesDir, 'cosign', 'verify-output-err1.txt')],
+  ])('parsing %p', async (fixturePath: string) => {
+    const signResult = Cosign.parseCommandOutput(fs.readFileSync(fixturePath, 'utf-8'));
+    expect(signResult).toBeDefined();
+    expect(signResult.bundle).toBeUndefined();
+    expect(signResult.errors).toBeDefined();
+  });
+});
--- a/tests/cosign/install.test.itg.ts
+++ b/tests/cosign/install.test.itg.ts
@@ -0,0 +1,53 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, test} from '@jest/globals';
+import * as fs from 'fs';
+
+import {Install} from '../../src/cosign/install';
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+describe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install cosign %s', async (version) => {
+      await expect((async () => {
+        const install = new Install();
+        const toolPath = await install.download({
+          version: version,
+          verifySignature: true
+        });
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.install(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});
+
+maybe('build', () => {
+  it.skip('builds refs/pull/4492/head', async () => {
+    const install = new Install();
+    const toolPath = await install.build('https://github.com/sigstore/cosign.git#refs/pull/4492/head');
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const buildxBin = await install.install(toolPath);
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 500000);
+});
--- a/tests/cosign/install.test.ts
+++ b/tests/cosign/install.test.ts
@@ -0,0 +1,137 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test, afterEach} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+import osm = require('os');
+
+import {Install} from '../../src/cosign/install';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'cosign-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v2.6.1'],
+    ['v3.0.1'],
+    ['latest']
+  ])(
+  'acquires %p of cosign', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download({version});
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const cosignBin = await install.install(toolPath, tmpDir);
+    expect(fs.existsSync(cosignBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v2.6.1'],
+    ['v3.0.1'],
+  ])(
+  'acquires %p of cosign with cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download({version});
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v2.5.3'],
+    ['v2.6.0'],
+  ])(
+  'acquires %p of cosign without cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download({
+      version: version,
+      ghaNoCache: true
+    });
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // TODO: add tests for arm
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64']
+  ])(
+  'acquires undock for %s/%s', async (os, arch) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const cosignBin = await install.download({
+      version: 'latest'
+    });
+    expect(fs.existsSync(cosignBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/sigstore/cosign/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/cosign-releases.json'
+    });
+  });
+  it('returns v3.0.2 download version', async () => {
+    const version = await Install.getDownloadVersion('v3.0.2');
+    expect(version.version).toEqual('v3.0.2');
+    expect(version.downloadURL).toEqual('https://github.com/sigstore/cosign/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/cosign-releases.json'
+    });
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v3.0.2 GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v3.0.2');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(253720294);
+    expect(release?.tag_name).toEqual('v3.0.2');
+    expect(release?.html_url).toEqual('https://github.com/sigstore/cosign/releases/tag/v3.0.2');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Cosign release foo in releases JSON'));
+  });
+});
--- a/tests/docker/install.test.itg.ts
+++ b/tests/docker/install.test.itg.ts
@@ -21,9 +21,7 @@ import path from 'path';

 import {Install, InstallSource, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
 import {Docker} from '../../src/docker/docker';
-import {Regctl} from '../../src/regclient/regctl';
 import {Install as RegclientInstall} from '../../src/regclient/install';
-import {Undock} from '../../src/undock/undock';
 import {Install as UndockInstall} from '../../src/undock/install';
 import {Exec} from '../../src/exec';

@@ -48,9 +46,7 @@ describe('root', () => {
        source: source,
        runDir: tmpDir(),
        contextName: 'foo',
-        daemonConfig: `{"debug":true,"features":{"containerd-snapshotter":true}}`,
-        regctl: new Regctl(),
-        undock: new Undock()
+        daemonConfig: `{"debug":true,"features":{"containerd-snapshotter":true}}`
      });
      await expect(tryInstall(install)).resolves.not.toThrow();
    }, 30 * 60 * 1000);
@@ -70,9 +66,7 @@ describe('rootless', () => {
        runDir: tmpDir(),
        contextName: 'foo',
        daemonConfig: `{"debug":true}`,
-        rootless: true,
-        regctl: new Regctl(),
-        undock: new Undock()
+        rootless: true
      });
      await expect(
        tryInstall(install, async () => {
@@ -97,9 +91,7 @@ describe('tcp', () => {
        runDir: tmpDir(),
        contextName: 'foo',
        daemonConfig: `{"debug":true}`,
-        localTCPPort: 2378,
-        regctl: new Regctl(),
-        undock: new Undock()
+        localTCPPort: 2378
      });
      await expect(
        tryInstall(install, async () => {
@@ -153,11 +145,12 @@ async function ensureNoSystemContainerd() {
 function getSources(root: boolean): Array<InstallSource> {
  const dockerInstallType = process.env.DOCKER_INSTALL_TYPE;
  const dockerInstallVersion = process.env.DOCKER_INSTALL_VERSION;
+  const dockerInstallChannel = process.env.DOCKER_INSTALL_CHANNEL || 'stable';
  if (dockerInstallType && dockerInstallVersion) {
    if (dockerInstallType === 'archive') {
      // prettier-ignore
      return [
-        { type: dockerInstallType, version: dockerInstallVersion, channel: 'stable'} as InstallSourceArchive
+        { type: dockerInstallType, version: dockerInstallVersion, channel: dockerInstallChannel} as InstallSourceArchive
      ];
    } else {
      // prettier-ignore
@@ -173,7 +166,8 @@ function getSources(root: boolean): Array<InstallSource> {
      {type: 'image', tag: 'master'} as InstallSourceImage,
      {type: 'image', tag: 'latest'} as InstallSourceImage,
      {type: 'archive', version: 'v26.1.4', channel: 'stable'} as InstallSourceArchive,
-      {type: 'archive', version: 'latest', channel: 'stable'} as InstallSourceArchive
+      {type: 'archive', version: 'latest', channel: 'stable'} as InstallSourceArchive,
+      {type: 'archive', version: 'v29.0.0-rc.1', channel: 'test'} as InstallSourceArchive
    ];
  } else {
    // prettier-ignore
--- a/tests/docker/install.test.ts
+++ b/tests/docker/install.test.ts
@@ -22,8 +22,6 @@ import * as rimraf from 'rimraf';
 import osm = require('os');

 import {Install, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
-import {Regctl} from '../../src/regclient/regctl';
-import {Undock} from '../../src/undock/undock';

 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-'));

@@ -53,6 +51,7 @@ describe('download', () => {
    [archive('v20.10.22', 'stable'), 'linux'],
    [archive('v20.10.22', 'stable'), 'darwin'],
    [archive('v20.10.22', 'stable'), 'win32'],
+    [archive('v29.0.0-rc.1', 'test'), 'linux'],

    [image('master'), 'linux'],
    [image('master'), 'win32'],
@@ -65,9 +64,7 @@ describe('download', () => {
    jest.spyOn(osm, 'arch').mockImplementation(() => 'x64');
    const install = new Install({
      source: source,
-      runDir: tmpDir,
-      regctl: new Regctl(),
-      undock: new Undock()
+      runDir: tmpDir
    });
    const toolPath = await install.download();
    expect(fs.existsSync(toolPath)).toBe(true);
@@ -81,7 +78,7 @@ describe('getRelease', () => {
    expect(release?.tag_name).not.toEqual('');
  });

-  it('returns v23.0.0 buildx GitHub release', async () => {
+  it('returns v23.0.0 docker GitHub release', async () => {
    const release = await Install.getRelease('v23.0.0');
    expect(release).not.toBeNull();
    expect(release?.id).toEqual(91109643);
@@ -89,8 +86,16 @@ describe('getRelease', () => {
    expect(release?.html_url).toEqual('https://github.com/moby/moby/releases/tag/v23.0.0');
  });

+  it('returns v29.0.0-rc.1 docker GitHub release', async () => {
+    const release = await Install.getRelease('v29.0.0-rc.1');
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(252020476);
+    expect(release?.tag_name).toEqual('docker-v29.0.0-rc.1');
+    expect(release?.html_url).toEqual('https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.1');
+  });
+
  it('unknown release', async () => {
-    await expect(Install.getRelease('foo')).rejects.toThrow(new Error('Cannot find Docker release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/docker-releases.json'));
+    await expect(Install.getRelease('foo')).rejects.toThrow(new Error('Cannot find Docker release foo in releases JSON'));
  });
 });

--- a/tests/git.test.ts
+++ b/tests/git.test.ts
@@ -57,7 +57,7 @@ describe('isInsideWorkTree', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    try {
      await Git.isInsideWorkTree();
-    } catch (err) {
+    } catch {
      // noop
    }
    expect(execSpy).toHaveBeenCalledWith(`git`, ['rev-parse', '--is-inside-work-tree'], {
@@ -81,7 +81,7 @@ describe('remoteURL', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    try {
      await Git.remoteURL();
-    } catch (err) {
+    } catch {
      // noop
    }
    expect(execSpy).toHaveBeenCalledWith(`git`, ['remote', 'get-url', 'origin'], {
@@ -233,6 +233,181 @@ describe('ref', () => {

    expect(ref).toEqual('refs/heads/test');
  });
+
+  it('returns mocked detached branch ref checked out by SHA', async () => {
+    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD, origin/feature-branch';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+
+    const ref = await Git.ref();
+
+    expect(ref).toEqual('refs/heads/feature-branch');
+  });
+
+  it('infers ref from local branch when detached HEAD returns only "HEAD"', async () => {
+    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = 'refs/heads/main\nrefs/heads/develop';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+
+    const ref = await Git.ref();
+
+    expect(ref).toEqual('refs/heads/main');
+  });
+
+  it('infers ref from remote branch when no local branch contains HEAD', async () => {
+    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = 'refs/remotes/origin/feature';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+
+    const ref = await Git.ref();
+
+    expect(ref).toEqual('refs/heads/feature');
+  });
+
+  it('infers ref from tag when no branch contains HEAD', async () => {
+    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = '';
+          break;
+        case 'git tag --contains HEAD':
+          result = 'v1.0.0\nv0.9.0';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+
+    const ref = await Git.ref();
+
+    expect(ref).toEqual('refs/tags/v1.0.0');
+  });
+
+  it('throws error when cannot infer ref from detached HEAD', async () => {
+    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = '';
+          break;
+        case 'git tag --contains HEAD':
+          result = '';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+
+    await expect(Git.ref()).rejects.toThrow('Cannot infer ref from detached HEAD');
+  });
+
+  it('handles remote ref without branch pattern when inferring from remote', async () => {
+    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = 'refs/remotes/unusual-format';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+
+    const ref = await Git.ref();
+
+    expect(ref).toEqual('refs/remotes/unusual-format');
+  });
 });

 describe('fullCommit', () => {
@@ -240,7 +415,7 @@ describe('fullCommit', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    try {
      await Git.fullCommit();
-    } catch (err) {
+    } catch {
      // noop
    }
    expect(execSpy).toHaveBeenCalledWith(`git`, ['show', '--format=%H', 'HEAD', '--quiet', '--'], {
@@ -255,7 +430,7 @@ describe('shortCommit', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    try {
      await Git.shortCommit();
-    } catch (err) {
+    } catch {
      // noop
    }
    expect(execSpy).toHaveBeenCalledWith(`git`, ['show', '--format=%h', 'HEAD', '--quiet', '--'], {
@@ -270,7 +445,7 @@ describe('tag', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    try {
      await Git.tag();
-    } catch (err) {
+    } catch {
      // noop
    }
    expect(execSpy).toHaveBeenCalledWith(`git`, ['tag', '--points-at', 'HEAD', '--sort', '-version:creatordate'], {
--- a/tests/github.test.ts
+++ b/tests/github.test.ts
@@ -14,7 +14,7 @@
 * limitations under the License.
 */

-import {describe, expect, jest, it, beforeEach, afterEach} from '@jest/globals';
+import {describe, expect, jest, it, beforeEach, afterEach, test} from '@jest/globals';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as core from '@actions/core';
@@ -43,6 +43,29 @@ describe('context', () => {
  });
 });

+describe('releases', () => {
+  // prettier-ignore
+  test.each([
+    ['.github/buildx-lab-releases.json'],
+    ['.github/buildx-releases.json'],
+    ['.github/compose-lab-releases.json'],
+    ['.github/compose-releases.json'],
+    ['.github/docker-releases.json'],
+    ['.github/regclient-releases.json'],
+    ['.github/undock-releases.json'],
+  ])('returns %p', async (path: string) => {
+    const github = new GitHub();
+    const releases = await github.releases('App', {
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: path
+    });
+    expect(releases).toBeDefined();
+    expect(Object.keys(releases).length).toBeGreaterThan(0);
+  });
+});
+
 describe('serverURL', () => {
  const originalEnv = process.env;
  beforeEach(() => {
@@ -118,6 +141,7 @@ describe('actionsRuntimeToken', () => {
  it('malformed', async () => {
    process.env.ACTIONS_RUNTIME_TOKEN = 'foo';
    expect(() => {
+      // eslint-disable-next-line @typescript-eslint/no-unused-expressions
      GitHub.actionsRuntimeToken;
    }).toThrow();
  });
--- a/tests/regclient/install.test.ts
+++ b/tests/regclient/install.test.ts
@@ -88,13 +88,23 @@ describe('getDownloadVersion', () => {
    const version = await Install.getDownloadVersion('latest');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/regclient-releases.json'
+    });
  });
  it('returns v0.8.1 download version', async () => {
    const version = await Install.getDownloadVersion('v0.8.1');
    expect(version.version).toEqual('v0.8.1');
    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/regclient-releases.json'
+    });
  });
 });

@@ -115,6 +125,6 @@ describe('getRelease', () => {
  });
  it('unknown release', async () => {
    const version = await Install.getDownloadVersion('foo');
-    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find regclient release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json'));
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find regclient release foo in releases JSON'));
  });
 });
--- a/tests/regclient/regctl.test.ts
+++ b/tests/regclient/regctl.test.ts
@@ -32,13 +32,12 @@ describe('manifestGet', () => {
    const manifest = await regctl.manifestGet({
      image: image,
    });
-    console.log(`${image} manifest: ${JSON.stringify(manifest, null, 2)}`);
    expect(manifest).not.toBeNull();
    expect(manifest?.config).toBeDefined();
    expect(manifest?.config.digest).not.toEqual('');
    expect(manifest?.layers).toBeDefined();
    expect(manifest?.layers.length).toBeGreaterThan(0);
-  });
+  }, 100000);
 });

 describe('blobGet', () => {
@@ -53,8 +52,7 @@ describe('blobGet', () => {
      digest: digest
    });
    expect(blob).toBeDefined();
-    console.log(`${repo}:@${digest} blob: ${JSON.stringify(JSON.parse(blob), null, 2)}`);
-  });
+  }, 100000);
 });

 describe('image config', () => {
@@ -75,12 +73,11 @@ describe('image config', () => {
      digest: manifest?.config.digest
    });
    const imageConfig = <Image>JSON.parse(blob);
-    console.log(`${image} config: ${JSON.stringify(imageConfig, null, 2)}`);
    expect(imageConfig).not.toBeNull();
    expect(imageConfig.config).toBeDefined();
    expect(imageConfig?.config?.Labels).toBeDefined();
    expect(Object.keys(imageConfig?.config?.Labels || {}).length).toBeGreaterThan(0);
-  });
+  }, 100000);
 });

 describe('isAvailable', () => {
@@ -88,7 +85,6 @@ describe('isAvailable', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    const regctl = new Regctl();
    await regctl.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
    expect(execSpy).toHaveBeenCalledWith(`regctl`, [], {
      silent: true,
      ignoreReturnCode: true
--- a/tests/sigstore/sigstore.test.itg.ts
+++ b/tests/sigstore/sigstore.test.itg.ts
@@ -0,0 +1,92 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, jest, it, beforeAll} from '@jest/globals';
+import fs from 'fs';
+import * as path from 'path';
+
+import {Install as CosignInstall} from '../../src/cosign/install';
+import {Sigstore} from '../../src/sigstore/sigstore';
+
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
+
+const maybe = process.env.GITHUB_ACTIONS && process.env.GITHUB_ACTIONS === 'true' && process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu') ? describe : describe.skip;
+
+// needs current GitHub repo info
+jest.unmock('@actions/github');
+
+beforeAll(async () => {
+  const cosignInstall = new CosignInstall();
+  const cosignBinPath = await cosignInstall.download({
+    version: 'v3.0.2'
+  });
+  await cosignInstall.install(cosignBinPath);
+}, 100000);
+
+maybe('signProvenanceBlobs', () => {
+  it('single platform', async () => {
+    const sigstore = new Sigstore();
+    const results = await sigstore.signProvenanceBlobs({
+      localExportDir: path.join(fixturesDir, 'sigstore', 'single')
+    });
+    expect(Object.keys(results).length).toEqual(1);
+    const provenancePath = Object.keys(results)[0];
+    expect(provenancePath).toEqual(path.join(fixturesDir, 'sigstore', 'single', 'provenance.json'));
+    expect(fs.existsSync(results[provenancePath].bundlePath)).toBe(true);
+    expect(results[provenancePath].payload).toBeDefined();
+    expect(results[provenancePath].certificate).toBeDefined();
+    expect(results[provenancePath].tlogID).toBeDefined();
+    console.log(provenancePath, JSON.stringify(results[provenancePath].payload, null, 2));
+  });
+  it('multi-platform', async () => {
+    const sigstore = new Sigstore();
+    const results = await sigstore.signProvenanceBlobs({
+      localExportDir: path.join(fixturesDir, 'sigstore', 'multi')
+    });
+    expect(Object.keys(results).length).toEqual(2);
+    for (const [provenancePath, res] of Object.entries(results)) {
+      expect(provenancePath).toMatch(/linux_(amd64|arm64)\/provenance.json/);
+      expect(fs.existsSync(res.bundlePath)).toBe(true);
+      expect(res.payload).toBeDefined();
+      expect(res.certificate).toBeDefined();
+      expect(res.tlogID).toBeDefined();
+      console.log(provenancePath, JSON.stringify(res.payload, null, 2));
+    }
+  });
+});
+
+maybe('verifySignedArtifacts', () => {
+  it('sign and verify', async () => {
+    const sigstore = new Sigstore();
+    const signResults = await sigstore.signProvenanceBlobs({
+      localExportDir: path.join(fixturesDir, 'sigstore', 'multi')
+    });
+    expect(Object.keys(signResults).length).toEqual(2);
+
+    const verifyResults = await sigstore.verifySignedArtifacts(
+      {
+        certificateIdentityRegexp: `^https://github.com/docker/actions-toolkit/.github/workflows/test.yml.*$`
+      },
+      signResults
+    );
+    expect(Object.keys(verifyResults).length).toEqual(2);
+    for (const [artifactPath, res] of Object.entries(verifyResults)) {
+      expect(fs.existsSync(artifactPath)).toBe(true);
+      expect(res.bundlePath).toBeDefined();
+      expect(res.cosignArgs).toBeDefined();
+    }
+  });
+});
--- a/tests/testResultsProcessor.js
+++ b/tests/testResultsProcessor.js
@@ -14,16 +14,14 @@
 * limitations under the License.
 */

-// eslint-disable-next-line @typescript-eslint/no-var-requires
+/* eslint-disable @typescript-eslint/no-require-imports */
 const fs = require('fs');

 module.exports = results => {
-  const allSkipped = results.testResults.every(result => {
-    return result.skipped;
-  });
+  const allSkipped = results.testResults.every(result => result.skipped);
  if (allSkipped) {
    console.log('All tests were skipped!');
-    // create an empty file to signal that all tests were skipped for CI
+    fs.mkdirSync('./coverage', {recursive: true});
    fs.closeSync(fs.openSync('./coverage/allSkipped.txt', 'w'));
  }
  return results;
--- a/tests/undock/install.test.ts
+++ b/tests/undock/install.test.ts
@@ -93,13 +93,23 @@ describe('getDownloadVersion', () => {
    const version = await Install.getDownloadVersion('latest');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/crazy-max/undock/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/undock-releases.json'
+    });
  });
  it('returns v0.6.0 download version', async () => {
    const version = await Install.getDownloadVersion('v0.6.0');
    expect(version.version).toEqual('v0.6.0');
    expect(version.downloadURL).toEqual('https://github.com/crazy-max/undock/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/undock-releases.json'
+    });
  });
 });

@@ -120,6 +130,6 @@ describe('getRelease', () => {
  });
  it('unknown release', async () => {
    const version = await Install.getDownloadVersion('foo');
-    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Undock release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json'));
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Undock release foo in releases JSON'));
  });
 });
--- a/tests/undock/undock.test.itg.ts
+++ b/tests/undock/undock.test.itg.ts
@@ -43,5 +43,5 @@ describe('run', () => {
        });
      })()
    ).resolves.not.toThrow();
-  }, 100000);
+  }, 500000);
 });
--- a/tests/undock/undock.test.ts
+++ b/tests/undock/undock.test.ts
@@ -38,7 +38,7 @@ describe('run', () => {
        });
      })()
    ).resolves.not.toThrow();
-  }, 100000);
+  }, 500000);
 });

 describe('isAvailable', () => {
@@ -46,7 +46,6 @@ describe('isAvailable', () => {
    const execSpy = jest.spyOn(Exec, 'getExecOutput');
    const undock = new Undock();
    await undock.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
    expect(execSpy).toHaveBeenCalledWith(`undock`, [], {
      silent: true,
      ignoreReturnCode: true
--- a/dev.Dockerfile
+++ b/dev.Dockerfile
@@ -15,11 +15,12 @@
 # limitations under the License.

 ARG NODE_VERSION=20
-ARG DOCKER_VERSION=27.2.1
-ARG BUILDX_VERSION=0.23.0
-ARG COMPOSE_VERSION=2.32.4
+ARG DOCKER_VERSION=28.3
+ARG BUILDX_VERSION=0.30.1
+ARG COMPOSE_VERSION=2.39.1
 ARG UNDOCK_VERSION=0.10.0
 ARG REGCTL_VERSION=v0.8.2
+ARG COSIGN_VERSION=v3.0.3

 FROM node:${NODE_VERSION}-alpine AS base
 RUN apk add --no-cache cpio findutils git
@@ -76,23 +77,25 @@ RUN --mount=type=bind,target=.,rw \
  --mount=type=cache,target=/src/node_modules \
  yarn run lint

-FROM docker:${DOCKER_VERSION} AS docker
+FROM dockereng/cli-bin:${DOCKER_VERSION} AS docker
 FROM docker/buildx-bin:${BUILDX_VERSION} AS buildx
 FROM docker/compose-bin:v${COMPOSE_VERSION} AS compose
 FROM crazymax/undock:${UNDOCK_VERSION} AS undock
 FROM ghcr.io/regclient/regctl:${REGCTL_VERSION} AS regctl
+FROM ghcr.io/sigstore/cosign/cosign:${COSIGN_VERSION} AS cosign

 FROM deps AS test
 RUN --mount=type=bind,target=.,rw \
    --mount=type=cache,target=/src/.yarn/cache \
    --mount=type=cache,target=/src/node_modules \
-    --mount=type=bind,from=docker,source=/usr/local/bin/docker,target=/usr/bin/docker \
+    --mount=type=bind,from=docker,source=/docker,target=/usr/bin/docker \
    --mount=type=bind,from=buildx,source=/buildx,target=/usr/libexec/docker/cli-plugins/docker-buildx \
    --mount=type=bind,from=buildx,source=/buildx,target=/usr/bin/buildx \
    --mount=type=bind,from=compose,source=/docker-compose,target=/usr/libexec/docker/cli-plugins/docker-compose \
    --mount=type=bind,from=compose,source=/docker-compose,target=/usr/bin/compose \
    --mount=type=bind,from=undock,source=/usr/local/bin/undock,target=/usr/bin/undock \
    --mount=type=bind,from=regctl,source=/regctl,target=/usr/bin/regctl \
+    --mount=type=bind,from=cosign,source=/ko-app/cosign,target=/usr/bin/cosign \
    --mount=type=secret,id=GITHUB_TOKEN \
  GITHUB_TOKEN=$(cat /run/secrets/GITHUB_TOKEN) yarn run test:coverage --coverageDirectory=/tmp/coverage

@@ -104,7 +107,7 @@ ARG GITHUB_REF
 RUN --mount=type=bind,target=.,rw \
    --mount=type=cache,target=/src/.yarn/cache \
    --mount=type=cache,target=/src/node_modules \
-    --mount=type=secret,id=NODE_AUTH_TOKEN <<EOT
+    --mount=type=secret,id=NODE_AUTH_TOKEN,env=NODE_AUTH_TOKEN <<EOT
  set -e
  if ! [[ $GITHUB_REF =~ ^refs/tags/v ]]; then
    echo "GITHUB_REF is not a tag"
@@ -112,10 +115,10 @@ RUN --mount=type=bind,target=.,rw \
  fi
  yarn install
  yarn run build
-  npm config set //registry.npmjs.org/:_authToken $(cat /run/secrets/NODE_AUTH_TOKEN)
+  npm config set //registry.npmjs.org/:_authToken $NODE_AUTH_TOKEN
  npm version --no-git-tag-version ${GITHUB_REF#refs/tags/v}
  npm publish --access public

  # FIXME: Can't publish with yarn berry atm: https://github.com/changesets/changesets/pull/674
-  #NODE_AUTH_TOKEN=$(cat /run/secrets/NODE_AUTH_TOKEN) yarn publish --no-git-tag-version --new-version ${GITHUB_REF#refs/tags/v}
+  #yarn publish --no-git-tag-version --new-version ${GITHUB_REF#refs/tags/v}
 EOT
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -0,0 +1,84 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+const {defineConfig, globalIgnores} = require('eslint/config');
+const {fixupConfigRules, fixupPluginRules} = require('@eslint/compat');
+const typescriptEslint = require('@typescript-eslint/eslint-plugin');
+const jestPlugin = require('eslint-plugin-jest');
+const prettier = require('eslint-plugin-prettier');
+const globals = require('globals');
+const tsParser = require('@typescript-eslint/parser');
+const js = require('@eslint/js');
+const {FlatCompat} = require('@eslint/eslintrc');
+
+// __dirname and __filename exist natively in CommonJS
+const compat = new FlatCompat({
+  baseDirectory: __dirname,
+  recommendedConfig: js.configs.recommended,
+  allConfig: js.configs.all
+});
+
+module.exports = defineConfig([
+  globalIgnores(['.yarn/**/*', 'lib/**/*', 'coverage/**/*', 'node_modules/**/*']),
+  {
+    extends: fixupConfigRules(
+      compat.extends(
+        'eslint:recommended',
+        'plugin:@typescript-eslint/eslint-recommended',
+        'plugin:@typescript-eslint/recommended',
+        'plugin:import/errors',
+        'plugin:import/typescript',
+        'plugin:import/warnings',
+        'plugin:jest/recommended',
+        'plugin:prettier/recommended'
+      )
+    ),
+
+    plugins: {
+      '@typescript-eslint': fixupPluginRules(typescriptEslint),
+      jest: fixupPluginRules(jestPlugin),
+      prettier: fixupPluginRules(prettier)
+    },
+
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...globals.mocha,
+        ...globals.jest
+      },
+      parser: tsParser,
+      ecmaVersion: 2023,
+      sourceType: 'commonjs'
+    },
+
+    rules: {
+      '@typescript-eslint/no-require-imports': [
+        'error',
+        {
+          allowAsImport: true
+        }
+      ],
+      'import/no-unresolved': [
+        'error',
+        {
+          ignore: ['csv-parse/sync', '@octokit/openapi-types']
+        }
+      ],
+      'jest/no-disabled-tests': 0
+    }
+  }
+]);
--- a/jest.config.itg.js
+++ b/jest.config.itg.js
@@ -26,6 +26,6 @@ module.exports = {
  moduleNameMapper: {
    '^csv-parse/sync': '<rootDir>/node_modules/csv-parse/dist/cjs/sync.cjs'
  },
-  testResultsProcessor: './__tests__/testResultsProcessor.ts',
+  testResultsProcessor: '<rootDir>/__tests__/testResultsProcessor.js',
  verbose: false
 };
--- a/jest.config.js
+++ b/jest.config.js
@@ -14,9 +14,10 @@
 * limitations under the License.
 */

-import fs from 'fs';
-import os from 'os';
-import path from 'path';
+/* eslint-disable @typescript-eslint/no-require-imports */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');

 const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-actions-toolkit-'));

@@ -28,9 +29,7 @@ process.env = Object.assign({}, process.env, {
  GITHUB_RUN_NUMBER: 15,
  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
-}) as {
-  [key: string]: string;
-};
+});

 module.exports = {
  clearMocks: true,
@@ -46,6 +45,6 @@ module.exports = {
  },
  collectCoverageFrom: ['src/**/{!(index.ts),}.ts'],
  coveragePathIgnorePatterns: ['lib/', 'node_modules/', '__mocks__/', '__tests__/'],
-  testResultsProcessor: './__tests__/testResultsProcessor.ts',
+  testResultsProcessor: '<rootDir>/__tests__/testResultsProcessor.js',
  verbose: true
 };
--- a/package.json
+++ b/package.json
@@ -12,9 +12,9 @@
    "prettier:fix": "prettier --write \"./**/*.ts\"",
    "test": "jest",
    "test:coverage": "jest --coverage",
-    "test:itg": "jest -c jest.config.itg.ts --runInBand --detectOpenHandles",
-    "test:itg-list": "jest -c jest.config.itg.ts --listTests",
-    "test:itg-coverage": "jest --coverage -c jest.config.itg.ts --runInBand --detectOpenHandles"
+    "test:itg": "jest -c jest.config.itg.js --runInBand",
+    "test:itg-list": "jest -c jest.config.itg.js --listTests",
+    "test:itg-coverage": "jest -c jest.config.itg.js --coverage --runInBand"
  },
  "repository": {
    "type": "git",
@@ -30,7 +30,7 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@3.6.3",
+  "packageManager": "yarn@4.9.2",
  "main": "lib/index.js",
  "types": "lib/index.d.ts",
  "directories": {
@@ -45,50 +45,57 @@
    "registry": "https://registry.npmjs.org/"
  },
  "dependencies": {
-    "@actions/artifact": "^2.3.2",
-    "@actions/cache": "^4.0.3",
-    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.0",
-    "@actions/http-client": "^2.2.3",
-    "@actions/io": "^1.1.3",
+    "@actions/artifact": "^5.0.1",
+    "@actions/cache": "^5.0.1",
+    "@actions/core": "^2.0.1",
+    "@actions/exec": "^2.0.0",
+    "@actions/github": "^6.0.1",
+    "@actions/http-client": "^3.0.0",
+    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^2.0.2",
-    "@azure/storage-blob": "^12.15.0",
-    "@octokit/core": "^5.1.0",
-    "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
+    "@azure/storage-blob": "^12.29.1",
+    "@octokit/core": "^5.2.2",
+    "@octokit/plugin-rest-endpoint-methods": "^10.4.1",
+    "@sigstore/bundle": "^4.0.0",
+    "@sigstore/sign": "^4.0.1",
+    "@sigstore/tuf": "^4.0.0",
+    "@sigstore/verify": "^3.0.0",
    "async-retry": "^1.3.3",
-    "csv-parse": "^5.6.0",
+    "csv-parse": "^6.1.0",
    "gunzip-maybe": "^1.4.2",
    "handlebars": "^4.7.8",
    "he": "^1.2.0",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
    "jwt-decode": "^4.0.0",
-    "semver": "^7.7.1",
+    "semver": "^7.7.3",
    "tar-stream": "^3.1.7",
-    "tmp": "^0.2.3"
+    "tmp": "^0.2.5"
  },
  "devDependencies": {
-    "@types/csv-parse": "^1.2.2",
-    "@types/gunzip-maybe": "^1.4.2",
+    "@eslint/compat": "^2.0.0",
+    "@eslint/eslintrc": "^3.3.3",
+    "@eslint/js": "^9.39.2",
+    "@sigstore/rekor-types": "^3.0.0",
+    "@types/gunzip-maybe": "^1.4.3",
    "@types/he": "^1.2.3",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.12.10",
-    "@types/semver": "^7.5.8",
-    "@types/tar-stream": "^3.1.3",
+    "@types/node": "^20.19.27",
+    "@types/semver": "^7.7.1",
+    "@types/tar-stream": "^3.1.4",
    "@types/tmp": "^0.2.6",
-    "@typescript-eslint/eslint-plugin": "^7.8.0",
-    "@typescript-eslint/parser": "^7.8.0",
-    "dotenv": "^16.4.5",
-    "eslint": "^8.57.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jest": "^28.5.0",
-    "eslint-plugin-prettier": "^5.1.3",
-    "jest": "^29.7.0",
-    "prettier": "^3.2.5",
-    "rimraf": "^5.0.5",
-    "ts-jest": "^29.1.2",
+    "@typescript-eslint/eslint-plugin": "^8.50.0",
+    "@typescript-eslint/parser": "^8.50.0",
+    "dotenv": "^17.2.3",
+    "eslint": "^9.39.2",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-jest": "^29.5.0",
+    "eslint-plugin-prettier": "^5.5.4",
+    "jest": "^30.2.0",
+    "prettier": "^3.7.4",
+    "rimraf": "^6.1.2",
+    "ts-jest": "^29.4.6",
    "ts-node": "^10.9.2",
-    "typescript": "^5.4.5"
+    "typescript": "^5.9.3"
  }
 }
--- a/src/buildkit/buildkit.ts
+++ b/src/buildkit/buildkit.ts
@@ -85,7 +85,7 @@ export class BuildKit {
      if (!bkversion) {
        try {
          bkversion = await this.getVersionWithinImage(node.name || '');
-        } catch (e) {
+        } catch {
          core.debug(`BuildKit.versionSatisfies ${node.name}: can't get version`);
          return false;
        }
--- a/src/buildx/bake.ts
+++ b/src/buildx/bake.ts
@@ -424,4 +424,34 @@ export class Bake {
    }
    return false;
  }
+
+  public static hasProvenanceAttestation(def: BakeDefinition): boolean {
+    return Bake.hasAttestationType('provenance', Bake.attestations(def));
+  }
+
+  public static hasSBOMAttestation(def: BakeDefinition): boolean {
+    return Bake.hasAttestationType('sbom', Bake.attestations(def));
+  }
+
+  public static hasAttestationType(name: string, attestations: Array<AttestEntry>): boolean {
+    for (const attestation of attestations) {
+      if (attestation.type == name) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  private static attestations(def: BakeDefinition): Array<AttestEntry> {
+    const attestations = new Array<AttestEntry>();
+    for (const key in def.target) {
+      const target = def.target[key];
+      if (target.attest) {
+        for (const attest of target.attest) {
+          attestations.push(Bake.parseAttestEntry(attest));
+        }
+      }
+    }
+    return attestations;
+  }
 }
--- a/src/buildx/build.ts
+++ b/src/buildx/build.ts
@@ -169,7 +169,7 @@ export class Build {
    }
    try {
      return core.getBooleanInput(name) ? `builder-id=${GitHub.workflowRunURL(true)}` : 'false';
-    } catch (err) {
+    } catch {
      // not a valid boolean, so we assume it's a string
      return Build.resolveProvenanceAttrs(input);
    }
@@ -302,7 +302,7 @@ export class Build {
          // https://github.com/docker/buildx/blob/8abef5908705e49f7ba88ef8c957e1127b597a2a/util/buildflags/attests.go#L13-L21
          const v = Util.parseBool(attr);
          res.push(`disabled=${!v}`);
-        } catch (err) {
+        } catch {
          res.push(attr);
        }
      }
--- a/src/buildx/buildx.ts
+++ b/src/buildx/buildx.ts
@@ -148,7 +148,7 @@ export class Buildx {
    let url: URL;
    try {
      url = new URL(endpoint);
-    } catch (e) {
+    } catch {
      return [];
    }
    if (url.protocol != 'tcp:') {
@@ -280,7 +280,7 @@ export class Buildx {
    const fnGitURL = function (inp: string): GitURL | undefined {
      try {
        return Git.parseURL(inp);
-      } catch (e) {
+      } catch {
        // noop
      }
    };
--- a/src/buildx/history.ts
+++ b/src/buildx/history.ts
@@ -105,8 +105,11 @@ export class History {
      return await this.exportLegacy(builderName, nodeName, refs, outDir, opts.image);
    }

-    // wait 3 seconds to ensure build records are finalized: https://github.com/moby/buildkit/pull/5109
-    await Util.sleep(3);
+    if (await this.buildx.versionSatisfies('<0.24.0')) {
+      // wait 3 seconds to ensure build records are finalized: https://github.com/moby/buildkit/pull/5109
+      // not necessary since buildx 0.24.0: https://github.com/docker/buildx/pull/3152
+      await Util.sleep(3);
+    }

    const summaries: Summaries = {};
    if (!opts.noSummaries) {
@@ -130,6 +133,7 @@ export class History {
            numCachedSteps: res.NumCachedSteps,
            numTotalSteps: res.NumTotalSteps,
            numCompletedSteps: res.NumCompletedSteps,
+            defaultPlatform: res.Platform?.[0],
            error: errorLogs
          };
        });
@@ -138,7 +142,12 @@ export class History {

    const dockerbuildPath = path.join(outDir, `${History.exportFilename(refs)}.dockerbuild`);

-    const cmd = await this.getExportCommand(['--builder', builderName, '--output', dockerbuildPath, ...refs]);
+    const exportArgs = ['--builder', builderName, '--output', dockerbuildPath, ...refs];
+    if (await this.buildx.versionSatisfies('>=0.24.0')) {
+      exportArgs.push('--finalize');
+    }
+
+    const cmd = await this.getExportCommand(exportArgs);
    await Exec.getExecOutput(cmd.command, cmd.args);

    const dockerbuildStats = fs.statSync(dockerbuildPath);
@@ -283,10 +292,10 @@ export class History {
    return {
      dockerbuildFilename: dockerbuildPath,
      dockerbuildSize: dockerbuildStats.size,
-      summaries: summaries,
      builderName: builderName,
      nodeName: nodeName,
-      refs: refs
+      refs: refs,
+      summaries: summaries
    };
  }

--- a/src/buildx/imagetools.ts
+++ b/src/buildx/imagetools.ts
@@ -17,7 +17,10 @@
 import {Buildx} from './buildx';
 import {Exec} from '../exec';

+import {Manifest as ImageToolsManifest} from '../types/buildx/imagetools';
 import {Image} from '../types/oci/config';
+import {Descriptor} from '../types/oci/descriptor';
+import {Digest} from '../types/oci/digest';

 export interface ImageToolsOpts {
  buildx?: Buildx;
@@ -58,4 +61,37 @@ export class ImageTools {
      throw new Error('Unexpected output format');
    });
  }
+
+  public async inspectManifest(name: string): Promise<ImageToolsManifest | Descriptor> {
+    const cmd = await this.getInspectCommand([name, '--format', '{{json .Manifest}}']);
+    return await Exec.getExecOutput(cmd.command, cmd.args, {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      const parsedOutput = JSON.parse(res.stdout);
+      if (typeof parsedOutput === 'object' && !Array.isArray(parsedOutput) && parsedOutput !== null) {
+        if (Object.prototype.hasOwnProperty.call(parsedOutput, 'manifests')) {
+          return <ImageToolsManifest>parsedOutput;
+        } else {
+          return <Descriptor>parsedOutput;
+        }
+      }
+      throw new Error('Unexpected output format');
+    });
+  }
+
+  public async attestationDescriptors(name: string): Promise<Array<Descriptor>> {
+    const manifest = await this.inspectManifest(name);
+    if (typeof manifest === 'object' && manifest !== null && 'manifests' in manifest && Array.isArray(manifest.manifests)) {
+      return manifest.manifests.filter(m => m.annotations && m.annotations['vnd.docker.reference.type'] === 'attestation-manifest');
+    }
+    throw new Error(`No attestation descriptors found for ${name}`);
+  }
+
+  public async attestationDigests(name: string): Promise<Array<Digest>> {
+    return (await this.attestationDescriptors(name)).map(attestation => attestation.digest);
+  }
 }
--- a/src/buildx/install.ts
+++ b/src/buildx/install.ts
@@ -18,7 +18,6 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
 import * as tc from '@actions/tool-cache';
 import * as semver from 'semver';
 import * as util from 'util';
@@ -29,6 +28,7 @@ import {Context} from '../context';
 import {Exec} from '../exec';
 import {Docker} from '../docker/docker';
 import {Git} from '../git';
+import {GitHub} from '../github';
 import {Util} from '../util';

 import {DownloadVersion} from '../types/buildx/buildx';
@@ -36,13 +36,16 @@ import {GitHubRelease} from '../types/github';

 export interface InstallOpts {
  standalone?: boolean;
+  githubToken?: string;
 }

 export class Install {
-  private readonly _standalone: boolean | undefined;
+  private readonly standalone: boolean | undefined;
+  private readonly githubToken: string | undefined;

  constructor(opts?: InstallOpts) {
-    this._standalone = opts?.standalone;
+    this.standalone = opts?.standalone;
+    this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
  }

  /*
@@ -55,7 +58,7 @@ export class Install {
    const version: DownloadVersion = await Install.getDownloadVersion(v);
    core.debug(`Install.download version: ${version.version}`);

-    const release: GitHubRelease = await Install.getRelease(version);
+    const release: GitHubRelease = await Install.getRelease(version, this.githubToken);
    core.debug(`Install.download release tag name: ${release.tag_name}`);

    const vspec = await this.vspec(release.tag_name);
@@ -83,7 +86,7 @@ export class Install {
    const downloadURL = util.format(version.downloadURL, vspec, this.filename(vspec));
    core.info(`Downloading ${downloadURL}`);

-    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    const htcDownloadPath = await tc.downloadTool(downloadURL, undefined, this.githubToken);
    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);

    const cacheSavePath = await installCache.save(htcDownloadPath);
@@ -205,7 +208,7 @@ export class Install {
  }

  private async isStandalone(): Promise<boolean> {
-    const standalone = this._standalone ?? !(await Docker.isAvailable());
+    const standalone = this.standalone ?? !(await Docker.isAvailable());
    core.debug(`Install.isStandalone: ${standalone}`);
    return standalone;
  }
@@ -285,7 +288,12 @@ export class Install {
          key: repoKey,
          version: version,
          downloadURL: 'https://github.com/docker/buildx/releases/download/v%s/%s',
-          releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json'
+          contentOpts: {
+            owner: 'docker',
+            repo: 'actions-toolkit',
+            ref: 'main',
+            path: '.github/buildx-releases.json'
+          }
        };
      }
      case 'cloud': {
@@ -293,7 +301,12 @@ export class Install {
          key: repoKey,
          version: version,
          downloadURL: 'https://github.com/docker/buildx-desktop/releases/download/v%s/%s',
-          releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json'
+          contentOpts: {
+            owner: 'docker',
+            repo: 'actions-toolkit',
+            ref: 'main',
+            path: '.github/buildx-lab-releases.json'
+          }
        };
      }
      default: {
@@ -302,17 +315,11 @@ export class Install {
    }
  }

-  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
-    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
-    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
-    const body = await resp.readBody();
-    const statusCode = resp.message.statusCode || 500;
-    if (statusCode >= 400) {
-      throw new Error(`Failed to get Buildx releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
-    }
-    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+  public static async getRelease(version: DownloadVersion, githubToken?: string): Promise<GitHubRelease> {
+    const github = new GitHub({token: githubToken});
+    const releases = await github.releases('Buildx', version.contentOpts);
    if (!releases[version.version]) {
-      throw new Error(`Cannot find Buildx release ${version.version} in ${version.releasesURL}`);
+      throw new Error(`Cannot find Buildx release ${version.version} in releases JSON`);
    }
    return releases[version.version];
  }
--- a/src/cache.ts
+++ b/src/cache.ts
@@ -64,8 +64,12 @@ export class Cache {

    if (!this.ghaNoCache && cache.isFeatureAvailable()) {
      if (skipState) {
-        core.debug(`Cache.save caching ${this.ghaCacheKey} to GitHub Actions cache`);
-        await cache.saveCache([this.cacheDir], this.ghaCacheKey);
+        try {
+          core.debug(`Cache.save caching ${this.ghaCacheKey} to GitHub Actions cache`);
+          await cache.saveCache([this.cacheDir], this.ghaCacheKey);
+        } catch (e) {
+          core.warning(`Failed to save cache: ${e}`);
+        }
      } else {
        core.debug(`Cache.save sending ${this.ghaCacheKey} to post state`);
        core.saveState(
@@ -82,26 +86,28 @@ export class Cache {
  }

  public async find(): Promise<string> {
-    let htcPath = tc.find(this.opts.htcName, this.opts.htcVersion, this.platform());
-    if (htcPath) {
-      core.info(`Restored from hosted tool cache ${htcPath}`);
-      return this.copyToCache(`${htcPath}/${this.opts.cacheFile}`);
-    }
-
-    if (!this.ghaNoCache && cache.isFeatureAvailable()) {
-      core.debug(`GitHub Actions cache feature available`);
-      if (await cache.restoreCache([this.cacheDir], this.ghaCacheKey)) {
-        core.info(`Restored ${this.ghaCacheKey} from GitHub Actions cache`);
-        htcPath = await tc.cacheDir(this.cacheDir, this.opts.htcName, this.opts.htcVersion, this.platform());
-        core.info(`Cached to hosted tool cache ${htcPath}`);
+    try {
+      let htcPath = tc.find(this.opts.htcName, this.opts.htcVersion, this.platform());
+      if (htcPath) {
+        core.info(`Restored from hosted tool cache ${htcPath}`);
        return this.copyToCache(`${htcPath}/${this.opts.cacheFile}`);
      }
-    } else if (this.ghaNoCache) {
-      core.info(`GitHub Actions cache disabled`);
-    } else {
-      core.info(`GitHub Actions cache feature not available`);
+      if (!this.ghaNoCache && cache.isFeatureAvailable()) {
+        core.debug(`GitHub Actions cache feature available`);
+        if (await cache.restoreCache([this.cacheDir], this.ghaCacheKey)) {
+          core.info(`Restored ${this.ghaCacheKey} from GitHub Actions cache`);
+          htcPath = await tc.cacheDir(this.cacheDir, this.opts.htcName, this.opts.htcVersion, this.platform());
+          core.info(`Cached to hosted tool cache ${htcPath}`);
+          return this.copyToCache(`${htcPath}/${this.opts.cacheFile}`);
+        }
+      } else if (this.ghaNoCache) {
+        core.info(`GitHub Actions cache disabled`);
+      } else {
+        core.info(`GitHub Actions cache feature not available`);
+      }
+    } catch (e) {
+      core.warning(`Failed to restore cache: ${e}`);
    }
-
    return '';
  }

@@ -120,13 +126,17 @@ export class Cache {
    if (!cacheState.dir || !cacheState.key) {
      throw new Error(`Invalid cache post state: ${state}`);
    }
-    core.info(`Caching ${cacheState.key} to GitHub Actions cache`);
-    await cache.saveCache([cacheState.dir], cacheState.key);
+    try {
+      core.info(`Caching ${cacheState.key} to GitHub Actions cache`);
+      await cache.saveCache([cacheState.dir], cacheState.key);
+    } catch (e) {
+      core.warning(`Failed to save cache: ${e}`);
+    }
    return cacheState;
  }

  private copyToCache(file: string): string {
-    core.debug(`Copying ${file} to ${this.cachePath}`);
+    core.info(`Copying ${file} to ${this.cachePath}`);
    fs.copyFileSync(file, this.cachePath);
    return this.cachePath;
  }
--- a/src/compose/install.ts
+++ b/src/compose/install.ts
@@ -18,27 +18,30 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
 import * as tc from '@actions/tool-cache';
 import * as semver from 'semver';
 import * as util from 'util';

 import {Cache} from '../cache';
 import {Context} from '../context';
+import {Docker} from '../docker/docker';
+import {GitHub} from '../github';

 import {DownloadVersion} from '../types/compose/compose';
 import {GitHubRelease} from '../types/github';
-import {Docker} from '../docker/docker';

 export interface InstallOpts {
  standalone?: boolean;
+  githubToken?: string;
 }

 export class Install {
-  private readonly _standalone: boolean | undefined;
+  private readonly standalone: boolean | undefined;
+  private readonly githubToken: string | undefined;

  constructor(opts?: InstallOpts) {
-    this._standalone = opts?.standalone;
+    this.standalone = opts?.standalone;
+    this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
  }

  /*
@@ -51,7 +54,7 @@ export class Install {
    const version: DownloadVersion = await Install.getDownloadVersion(v);
    core.debug(`Install.download version: ${version.version}`);

-    const release: GitHubRelease = await Install.getRelease(version);
+    const release: GitHubRelease = await Install.getRelease(version, this.githubToken);
    core.debug(`Install.download release tag name: ${release.tag_name}`);

    const vspec = await this.vspec(release.tag_name);
@@ -79,7 +82,7 @@ export class Install {
    const downloadURL = util.format(version.downloadURL, vspec, this.filename());
    core.info(`Downloading ${downloadURL}`);

-    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    const htcDownloadPath = await tc.downloadTool(downloadURL, undefined, this.githubToken);
    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);

    const cacheSavePath = await installCache.save(htcDownloadPath);
@@ -129,7 +132,7 @@ export class Install {
  }

  private async isStandalone(): Promise<boolean> {
-    const standalone = this._standalone ?? !(await Docker.isAvailable());
+    const standalone = this.standalone ?? !(await Docker.isAvailable());
    core.debug(`Install.isStandalone: ${standalone}`);
    return standalone;
  }
@@ -183,7 +186,12 @@ export class Install {
          key: repoKey,
          version: version,
          downloadURL: 'https://github.com/docker/compose/releases/download/v%s/%s',
-          releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json'
+          contentOpts: {
+            owner: 'docker',
+            repo: 'actions-toolkit',
+            ref: 'main',
+            path: '.github/compose-releases.json'
+          }
        };
      }
      case 'cloud': {
@@ -191,7 +199,12 @@ export class Install {
          key: repoKey,
          version: version,
          downloadURL: 'https://github.com/docker/compose-desktop/releases/download/v%s/%s',
-          releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-lab-releases.json'
+          contentOpts: {
+            owner: 'docker',
+            repo: 'actions-toolkit',
+            ref: 'main',
+            path: '.github/compose-lab-releases.json'
+          }
        };
      }
      default: {
@@ -200,17 +213,11 @@ export class Install {
    }
  }

-  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
-    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
-    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
-    const body = await resp.readBody();
-    const statusCode = resp.message.statusCode || 500;
-    if (statusCode >= 400) {
-      throw new Error(`Failed to get Compose releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
-    }
-    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+  public static async getRelease(version: DownloadVersion, githubToken?: string): Promise<GitHubRelease> {
+    const github = new GitHub({token: githubToken});
+    const releases = await github.releases('Compose', version.contentOpts);
    if (!releases[version.version]) {
-      throw new Error(`Cannot find Compose release ${version.version} in ${version.releasesURL}`);
+      throw new Error(`Cannot find Compose release ${version.version} in releases JSON`);
    }
    return releases[version.version];
  }
--- a/src/cosign/cosign.ts
+++ b/src/cosign/cosign.ts
@@ -0,0 +1,160 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as core from '@actions/core';
+import {BUNDLE_V03_MEDIA_TYPE, SerializedBundle} from '@sigstore/bundle';
+
+import {Exec} from '../exec';
+import * as semver from 'semver';
+import {MEDIATYPE_EMPTY_JSON_V1} from '../types/oci/mediatype';
+
+export interface CosignOpts {
+  binPath?: string;
+}
+
+export interface CosignCommandResult {
+  bundle?: SerializedBundle;
+  signatureManifestDigest?: string;
+  errors?: Array<CosignCommandError>;
+}
+
+export interface CosignCommandError {
+  code: string;
+  message: string;
+  detail: string;
+}
+
+export class Cosign {
+  private readonly binPath: string;
+  private _version: string;
+  private _versionOnce: boolean;
+
+  constructor(opts?: CosignOpts) {
+    this.binPath = opts?.binPath || 'cosign';
+    this._version = '';
+    this._versionOnce = false;
+  }
+
+  public async isAvailable(): Promise<boolean> {
+    const ok: boolean = await Exec.getExecOutput(this.binPath, [], {
+      ignoreReturnCode: true,
+      silent: true
+    })
+      .then(res => {
+        if (res.stderr.length > 0 && res.exitCode != 0) {
+          core.debug(`Cosign.isAvailable cmd err: ${res.stderr.trim()}`);
+          return false;
+        }
+        return res.exitCode == 0;
+      })
+      .catch(error => {
+        core.debug(`Cosign.isAvailable error: ${error}`);
+        return false;
+      });
+
+    core.debug(`Cosign.isAvailable: ${ok}`);
+    return ok;
+  }
+
+  public async version(): Promise<string> {
+    if (this._versionOnce) {
+      return this._version;
+    }
+    this._versionOnce = true;
+    this._version = await Exec.getExecOutput(this.binPath, ['version', '--json'], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return JSON.parse(res.stdout.trim()).gitVersion;
+    });
+    return this._version;
+  }
+
+  public async printVersion() {
+    await Exec.exec(this.binPath, ['version', '--json'], {
+      failOnStdErr: false
+    });
+  }
+
+  public async versionSatisfies(range: string, version?: string): Promise<boolean> {
+    const ver = version ?? (await this.version());
+    if (!ver) {
+      core.debug(`Cosign.versionSatisfies false: undefined version`);
+      return false;
+    }
+    const res = semver.satisfies(ver, range) || /^[0-9a-f]{7}$/.exec(ver) !== null;
+    core.debug(`Cosign.versionSatisfies ${ver} statisfies ${range}: ${res}`);
+    return res;
+  }
+
+  public static parseCommandOutput(logs: string): CosignCommandResult {
+    let signatureManifestDigest: string | undefined;
+    let signatureManifestFallbackDigest: string | undefined;
+    let bundlePayload: SerializedBundle | undefined;
+    let errors: Array<CosignCommandError> | undefined;
+
+    for (const rawLine of logs.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (!line.startsWith('{') || !line.endsWith('}')) {
+        continue;
+      }
+
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      let obj: any;
+      try {
+        obj = JSON.parse(line);
+      } catch {
+        continue;
+      }
+
+      if (obj && Array.isArray(obj.errors) && obj.errors.length > 0) {
+        errors = obj.errors;
+      }
+
+      // signature manifest digest
+      if (!signatureManifestDigest && obj && Array.isArray(obj.manifests) && obj.manifests.length > 0) {
+        const m0 = obj.manifests[0];
+        if (m0?.artifactType === BUNDLE_V03_MEDIA_TYPE && typeof m0.digest === 'string') {
+          signatureManifestDigest = m0.digest;
+        } else if (m0?.artifactType === MEDIATYPE_EMPTY_JSON_V1 && typeof m0.digest === 'string') {
+          signatureManifestFallbackDigest = m0.digest;
+        }
+      }
+
+      // signature payload
+      if (!bundlePayload && obj && obj.mediaType === BUNDLE_V03_MEDIA_TYPE) {
+        bundlePayload = obj as SerializedBundle;
+      }
+
+      if (bundlePayload && signatureManifestDigest) {
+        break;
+      }
+    }
+
+    if (!errors && !bundlePayload) {
+      throw new Error(`Cannot find signature bundle from cosign command output: ${logs}`);
+    }
+
+    return {
+      bundle: bundlePayload,
+      signatureManifestDigest: signatureManifestDigest || signatureManifestFallbackDigest,
+      errors: errors
+    };
+  }
+}
--- a/src/cosign/dockerfile.ts
+++ b/src/cosign/dockerfile.ts
@@ -0,0 +1,61 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export const dockerfileContent = `
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION="1.24"
+ARG ALPINE_VERSION="3.22"
+
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.7.0 AS xx
+
+FROM --platform=$BUILDPLATFORM golang:\${GO_VERSION}-alpine\${ALPINE_VERSION} AS builder-base
+COPY --from=xx / /
+RUN apk add --no-cache git
+ENV GOTOOLCHAIN=auto
+ENV CGO_ENABLED=0
+WORKDIR /src
+RUN --mount=type=cache,target=/go/pkg/mod \\
+    --mount=type=bind,source=go.mod,target=go.mod \\
+    --mount=type=bind,source=go.sum,target=go.sum \\
+    go mod download
+
+FROM builder-base AS version
+RUN --mount=type=bind,target=. <<'EOT'
+  git rev-parse HEAD 2>/dev/null || {
+    echo >&2 "Failed to get git revision, make sure --build-arg BUILDKIT_CONTEXT_KEEP_GIT_DIR=1 is set when building from Git directly"
+    exit 1
+  }
+  set -ex
+  export PKG=sigs.k8s.io BUILDDATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") TREESTATE=$(if ! git diff --no-ext-diff --quiet --exit-code; then echo dirty; else echo clean; fi) VERSION=$(git describe --match 'v[0-9]*' --dirty='.m' --always --tags) COMMIT=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi);
+  echo "-X \${PKG}/release-utils/version.gitVersion=\${VERSION} -X \${PKG}/release-utils/version.gitCommit=\${COMMIT} -X \${PKG}/release-utils/version.gitTreeState=\${TREESTATE} -X \${PKG}/release-utils/version.buildDate=\${BUILDDATE}" > /tmp/.ldflags;
+  echo -n "\${VERSION}" > /tmp/.version;
+EOT
+
+FROM builder-base AS builder
+ARG TARGETPLATFORM
+RUN --mount=type=bind,target=. \\
+    --mount=type=cache,target=/root/.cache,id=cosign-$TARGETPLATFORM \\
+    --mount=source=/tmp/.ldflags,target=/tmp/.ldflags,from=version \\
+    --mount=type=cache,target=/go/pkg/mod <<EOT
+  set -ex
+  xx-go build -trimpath -ldflags "-s -w $(cat /tmp/.ldflags)" -o /out/cosign ./cmd/cosign
+  xx-verify --static /out/cosign
+EOT
+
+FROM scratch
+COPY --from=builder /out /
+`;
--- a/src/cosign/install.ts
+++ b/src/cosign/install.ts
@@ -0,0 +1,291 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as core from '@actions/core';
+import * as tc from '@actions/tool-cache';
+import {bundleFromJSON, SerializedBundle} from '@sigstore/bundle';
+import * as tuf from '@sigstore/tuf';
+import {toSignedEntity, toTrustMaterial, Verifier} from '@sigstore/verify';
+import * as semver from 'semver';
+import * as util from 'util';
+
+import {Buildx} from '../buildx/buildx';
+import {Cache} from '../cache';
+import {Context} from '../context';
+import {Exec} from '../exec';
+import {Git} from '../git';
+import {GitHub} from '../github';
+import {Util} from '../util';
+
+import {DownloadVersion} from '../types/cosign/cosign';
+import {GitHubRelease} from '../types/github';
+import {dockerfileContent} from './dockerfile';
+
+export interface DownloadOpts {
+  version: string;
+  ghaNoCache?: boolean;
+  skipState?: boolean;
+  verifySignature?: boolean;
+}
+
+export interface InstallOpts {
+  githubToken?: string;
+  buildx?: Buildx;
+}
+
+export class Install {
+  private readonly githubToken: string | undefined;
+  private readonly buildx: Buildx;
+
+  constructor(opts?: InstallOpts) {
+    this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
+    this.buildx = opts?.buildx || new Buildx();
+  }
+
+  public async download(opts: DownloadOpts): Promise<string> {
+    const version: DownloadVersion = await Install.getDownloadVersion(opts.version);
+    core.debug(`Install.download version: ${version.version}`);
+
+    const release: GitHubRelease = await Install.getRelease(version, this.githubToken);
+    core.debug(`Install.download release tag name: ${release.tag_name}`);
+
+    const vspec = await this.vspec(release.tag_name);
+    core.debug(`Install.download vspec: ${vspec}`);
+
+    const c = semver.clean(vspec) || '';
+    if (!semver.valid(c)) {
+      throw new Error(`Invalid Cosign version "${vspec}".`);
+    }
+
+    const installCache = new Cache({
+      htcName: 'cosign-dl-bin',
+      htcVersion: vspec,
+      baseCacheDir: path.join(os.homedir(), '.bin'),
+      cacheFile: os.platform() == 'win32' ? 'cosign.exe' : 'cosign',
+      ghaNoCache: opts.ghaNoCache
+    });
+
+    const cacheFoundPath = await installCache.find();
+    if (cacheFoundPath) {
+      core.info(`Cosign binary found in ${cacheFoundPath}`);
+      return cacheFoundPath;
+    }
+
+    const downloadURL = util.format(version.downloadURL, vspec, this.filename());
+    core.info(`Downloading ${downloadURL}`);
+
+    const htcDownloadPath = await tc.downloadTool(downloadURL, undefined, this.githubToken);
+    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);
+
+    if (opts.verifySignature && semver.satisfies(vspec, '>=3.0.1')) {
+      await this.verifySignature(htcDownloadPath, downloadURL);
+    }
+
+    const cacheSavePath = await installCache.save(htcDownloadPath, opts.skipState);
+    core.info(`Cached to ${cacheSavePath}`);
+    return cacheSavePath;
+  }
+
+  public async build(gitContext: string, ghaNoCache?: boolean, skipState?: boolean): Promise<string> {
+    const vspec = await this.vspec(gitContext);
+    core.debug(`Install.build vspec: ${vspec}`);
+
+    const installCache = new Cache({
+      htcName: 'cosign-build-bin',
+      htcVersion: vspec,
+      baseCacheDir: path.join(os.homedir(), '.bin'),
+      cacheFile: os.platform() == 'win32' ? 'cosign.exe' : 'cosign',
+      ghaNoCache: ghaNoCache
+    });
+
+    const cacheFoundPath = await installCache.find();
+    if (cacheFoundPath) {
+      core.info(`Cosign binary found in ${cacheFoundPath}`);
+      return cacheFoundPath;
+    }
+
+    const outputDir = path.join(Context.tmpDir(), 'cosign-build-cache');
+    const buildCmd = await this.buildCommand(gitContext, outputDir);
+
+    const buildBinPath = await Exec.getExecOutput(buildCmd.command, buildCmd.args, {
+      ignoreReturnCode: true,
+      input: Buffer.from(dockerfileContent)
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(`build failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+      }
+      return `${outputDir}/cosign`;
+    });
+
+    const cacheSavePath = await installCache.save(buildBinPath, skipState);
+    core.info(`Cached to ${cacheSavePath}`);
+    return cacheSavePath;
+  }
+
+  public async install(binPath: string, dest?: string): Promise<string> {
+    dest = dest || Context.tmpDir();
+
+    const binDir = path.join(dest, 'cosign-bin');
+    if (!fs.existsSync(binDir)) {
+      fs.mkdirSync(binDir, {recursive: true});
+    }
+    const binName: string = os.platform() == 'win32' ? 'cosign.exe' : 'cosign';
+    const cosignPath: string = path.join(binDir, binName);
+    fs.copyFileSync(binPath, cosignPath);
+
+    core.info('Fixing perms');
+    fs.chmodSync(cosignPath, '0755');
+
+    core.addPath(binDir);
+    core.info('Added Cosign to PATH');
+
+    core.info(`Binary path: ${cosignPath}`);
+    return cosignPath;
+  }
+
+  private async buildCommand(gitContext: string, outputDir: string): Promise<{args: Array<string>; command: string}> {
+    const buildxStandaloneFound = await new Buildx({standalone: true}).isAvailable();
+    const buildxPluginFound = await new Buildx({standalone: false}).isAvailable();
+
+    let buildStandalone = false;
+    if ((await this.buildx.isStandalone()) && buildxStandaloneFound) {
+      core.debug(`Install.buildCommand: Buildx standalone found, build with it`);
+      buildStandalone = true;
+    } else if (!(await this.buildx.isStandalone()) && buildxPluginFound) {
+      core.debug(`Install.buildCommand: Buildx plugin found, build with it`);
+      buildStandalone = false;
+    } else if (buildxStandaloneFound) {
+      core.debug(`Install.buildCommand: Buildx plugin not found, but standalone found so trying to build with it`);
+      buildStandalone = true;
+    } else if (buildxPluginFound) {
+      core.debug(`Install.buildCommand: Buildx standalone not found, but plugin found so trying to build with it`);
+      buildStandalone = false;
+    } else {
+      throw new Error(`Neither buildx standalone or plugin have been found to build from ref ${gitContext}`);
+    }
+
+    const args = ['build', '--platform', 'local', '--build-arg', 'BUILDKIT_CONTEXT_KEEP_GIT_DIR=1', '--output', `type=local,dest=${outputDir}`];
+    if (process.env.GIT_AUTH_TOKEN) {
+      args.push('--secret', 'id=GIT_AUTH_TOKEN');
+    }
+    args.push('-f-', gitContext);
+
+    // prettier-ignore
+    return await new Buildx({standalone: buildStandalone}).getCommand(args);
+  }
+
+  private async verifySignature(cosignBinPath: string, downloadURL: string): Promise<void> {
+    const bundleURL = `${downloadURL}.sigstore.json`;
+    core.info(`Downloading keyless verification bundle at ${bundleURL}`);
+    const bundlePath = await tc.downloadTool(bundleURL, undefined, this.githubToken);
+    core.debug(`Install.verifySignature bundlePath: ${bundlePath}`);
+
+    core.info(`Verifying keyless verification bundle signature`);
+    const parsedBundle = JSON.parse(fs.readFileSync(bundlePath, 'utf-8')) as SerializedBundle;
+    const bundle = bundleFromJSON(parsedBundle);
+
+    core.info(`Fetching Sigstore TUF trusted root metadata`);
+    const trustedRoot = await tuf.getTrustedRoot();
+    const trustMaterial = toTrustMaterial(trustedRoot);
+
+    try {
+      core.info(`Verifying cosign binary signature`);
+      const signedEntity = toSignedEntity(bundle, fs.readFileSync(cosignBinPath));
+      const verifier = new Verifier(trustMaterial);
+      const signer = verifier.verify(signedEntity, {
+        subjectAlternativeName: 'keyless@projectsigstore.iam.gserviceaccount.com',
+        extensions: {issuer: 'https://accounts.google.com'}
+      });
+      core.debug(`Install.verifySignature signer: ${JSON.stringify(signer)}`);
+      core.info(`Cosign binary signature verified!`);
+    } catch (err) {
+      throw new Error(`Failed to verify cosign binary signature: ${err}`);
+    }
+  }
+
+  private filename(): string {
+    let arch: string;
+    switch (os.arch()) {
+      case 'x64': {
+        arch = 'amd64';
+        break;
+      }
+      case 'ppc64': {
+        arch = 'ppc64le';
+        break;
+      }
+      default: {
+        arch = os.arch();
+        break;
+      }
+    }
+    const platform: string = os.platform() == 'win32' ? 'windows' : os.platform();
+    const ext: string = os.platform() == 'win32' ? '.exe' : '';
+    return util.format('cosign-%s-%s%s', platform, arch, ext);
+  }
+
+  private async vspec(versionOrRef: string): Promise<string> {
+    if (!Util.isValidRef(versionOrRef)) {
+      const v = versionOrRef.replace(/^v+|v+$/g, '');
+      core.info(`Use ${v} version spec cache key for ${versionOrRef}`);
+      return v;
+    }
+
+    // eslint-disable-next-line prefer-const
+    let [baseURL, ref] = versionOrRef.split('#');
+    if (ref.length == 0) {
+      ref = 'master';
+    }
+
+    let sha: string;
+    if (ref.match(/^[0-9a-fA-F]{40}$/)) {
+      sha = ref;
+    } else {
+      sha = await Git.remoteSha(baseURL, ref, process.env.GIT_AUTH_TOKEN);
+    }
+
+    const [owner, repo] = baseURL.substring('https://github.com/'.length).split('/');
+    const key = `${owner}/${Util.trimSuffix(repo, '.git')}/${sha}`;
+    const hash = Util.hash(key);
+    core.info(`Use ${hash} version spec cache key for ${key}`);
+    return hash;
+  }
+
+  public static async getDownloadVersion(v: string): Promise<DownloadVersion> {
+    return {
+      version: v,
+      downloadURL: 'https://github.com/sigstore/cosign/releases/download/v%s/%s',
+      contentOpts: {
+        owner: 'docker',
+        repo: 'actions-toolkit',
+        ref: 'main',
+        path: '.github/cosign-releases.json'
+      }
+    };
+  }
+
+  public static async getRelease(version: DownloadVersion, githubToken?: string): Promise<GitHubRelease> {
+    const github = new GitHub({token: githubToken});
+    const releases = await github.releases('Cosign', version.contentOpts);
+    if (!releases[version.version]) {
+      throw new Error(`Cannot find Cosign release ${version.version} in releases JSON`);
+    }
+    return releases[version.version];
+  }
+}
--- a/src/docker/assets.ts
+++ b/src/docker/assets.ts
@@ -140,7 +140,10 @@ Get-WinEvent -ea SilentlyContinue \`
 `;

 export const limaYamlData = `
-# Source: https://github.com/lima-vm/lima/blob/master/templates/docker-rootful.yaml
+# Source:
+# - https://github.com/lima-vm/lima/blob/master/templates/docker-rootful.yaml
+# - https://github.com/lima-vm/lima/blob/master/templates/_images/ubuntu-lts.yaml
+# - https://github.com/lima-vm/lima/blob/master/templates/_images/ubuntu-24.04.yaml

 # VM type: "qemu" or "vz" (on macOS 13 and later).
 # The vmType can be specified only on creating the instance.
@@ -162,24 +165,24 @@ images:
  arch: "{{arch}}"
  digest: "{{digest}}"
 {{/each}}
- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/ubuntu-24.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250704/ubuntu-24.04-server-cloudimg-amd64.img"
  arch: "x86_64"
-  digest: "sha256:a3aea891c930ee0c762077b963834f5e083eb8102574f1e4dfc9e6e4c1c73ac0"
+  digest: "sha256:f1652d29d497fb7c623433705c9fca6525d1311b11294a0f495eed55c7639d1f"
  kernel:
-    location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/unpacked/ubuntu-24.04-server-cloudimg-amd64-vmlinuz-generic"
-    digest: "sha256:2d9f30959f01675fd28aa1c2fe8934728e46766d04ecfad2d206823696a3f830"
+    location: "https://cloud-images.ubuntu.com/releases/noble/release-20250704/unpacked/ubuntu-24.04-server-cloudimg-amd64-vmlinuz-generic"
+    digest: "sha256:67cd9af083515de2101de032b49a64fc4b65778e5383df6ef21cf788a3f4688e"
    cmdline: "root=LABEL=cloudimg-rootfs ro console=tty1 console=ttyAMA0 no_timer_check"
  initrd:
-    location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/unpacked/ubuntu-24.04-server-cloudimg-amd64-initrd-generic"
-    digest: "sha256:231352d027aeebf0bb7dca281dfebae894c86e789c7377788d3c2c149471caa3"
- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/ubuntu-24.04-server-cloudimg-arm64.img"
+    location: "https://cloud-images.ubuntu.com/releases/noble/release-20250704/unpacked/ubuntu-24.04-server-cloudimg-amd64-initrd-generic"
+    digest: "sha256:f257d581c44f66da2d80c7c5dc3fa598ce76ef313d6e27b368683e8030a9e8fd"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250704/ubuntu-24.04-server-cloudimg-arm64.img"
  arch: "aarch64"
-  digest: "sha256:278a0e8475008673d9d3da10ae66a7b1a3dda059746b83d749eca386a5670bd4"
+  digest: "sha256:bbecbb88100ee65497927ed0da247ba15af576a8855004182cf3c87265e25d35"
 # Fallback to the latest release image.
 # Hint: run \`limactl prune\` to invalidate the cache
- location: "https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.img"
+- location: https://cloud-images.ubuntu.com/releases/noble/release/ubuntu-24.04-server-cloudimg-amd64.img
  arch: "x86_64"
- location: "https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-arm64.img"
+- location: https://cloud-images.ubuntu.com/releases/noble/release/ubuntu-24.04-server-cloudimg-arm64.img
  arch: "aarch64"

 # CPUs
@@ -290,18 +293,25 @@ probes:
    #!/bin/bash
    set -eux -o pipefail
    # Don't check for docker CLI as it's not installed in the VM (only on the host)
-    if ! timeout 30s bash -c "until pgrep dockerd; do sleep 3; done"; then
+    if ! timeout 60s bash -c "until pgrep dockerd; do sleep 3; done"; then
      echo >&2 "dockerd is not running"
      exit 1
    fi
  hint: See "/var/log/cloud-init-output.log". in the guest

 hostResolver:
+  # Don't use local system resolver
+  enabled: false
  # hostResolver.hosts requires lima 0.8.3 or later. Names defined here will also
  # resolve inside containers, and not just inside the VM itself.
  hosts:
    host.docker.internal: host.lima.internal

+# Use custom DNS servers instead of the host's DNS settings
+dns:
+  - 1.1.1.1
+  - 1.0.0.1
+
 portForwards:
 - guestSocket: "/var/run/docker.sock"
  hostSocket: "{{dockerSock}}"
--- a/src/docker/docker.ts
+++ b/src/docker/docker.ts
@@ -60,7 +60,7 @@ export class Docker {
        silent: true
      });
      return true;
-    } catch (e) {
+    } catch {
      return false;
    }
  }
--- a/src/docker/install.ts
+++ b/src/docker/install.ts
@@ -22,16 +22,17 @@ import path from 'path';
 import retry from 'async-retry';
 import * as handlebars from 'handlebars';
 import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
 import * as io from '@actions/io';
 import * as tc from '@actions/tool-cache';

 import {Context} from '../context';
 import {Docker} from './docker';
+import {Exec} from '../exec';
+import {GitHub} from '../github';
 import {Regctl} from '../regclient/regctl';
 import {Undock} from '../undock/undock';
-import {Exec} from '../exec';
 import {Util} from '../util';
+
 import {limaYamlData, dockerServiceLogsPs1, setupDockerWinPs1} from './assets';

 import {GitHubRelease} from '../types/github';
@@ -60,8 +61,10 @@ export interface InstallOpts {
  rootless?: boolean;
  localTCPPort?: number;

-  regctl: Regctl;
-  undock: Undock;
+  regctl?: Regctl;
+  undock?: Undock;
+
+  githubToken?: string;
 }

 interface LimaImage {
@@ -79,6 +82,7 @@ export class Install {
  private readonly localTCPPort?: number;
  private readonly regctl: Regctl;
  private readonly undock: Undock;
+  private readonly githubToken?: string;

  private _version: string | undefined;
  private _toolDir: string | undefined;
@@ -98,8 +102,9 @@ export class Install {
    this.daemonConfig = opts.daemonConfig;
    this.rootless = opts.rootless || false;
    this.localTCPPort = opts.localTCPPort;
-    this.regctl = opts.regctl;
-    this.undock = opts.undock;
+    this.regctl = opts.regctl || new Regctl();
+    this.undock = opts.undock || new Undock();
+    this.githubToken = opts.githubToken || process.env.GITHUB_TOKEN;
  }

  get toolDir(): string {
@@ -203,8 +208,8 @@ export class Install {
  }

  private async downloadSourceArchive(component: 'docker' | 'docker-rootless-extras', src: InstallSourceArchive): Promise<string> {
-    const release: GitHubRelease = await Install.getRelease(src.version);
-    this._version = release.tag_name.replace(/^v+|v+$/g, '');
+    const release: GitHubRelease = await Install.getRelease(src.version, this.githubToken);
+    this._version = release.tag_name.replace(/^(docker-)?v+/, '');
    core.debug(`docker.Install.downloadSourceArchive version: ${this._version}`);

    const downloadURL = this.downloadURL(component, this._version, src.channel);
@@ -264,22 +269,12 @@ export class Install {
    await io.mkdirP(limaDir);
    const dockerHost = `unix://${limaDir}/docker.sock`;

-    // avoid brew to auto update and upgrade unrelated packages.
-    let envs = Object.assign({}, process.env, {
-      HOMEBREW_NO_AUTO_UPDATE: '1',
-      HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: '1'
-    }) as {
-      [key: string]: string;
-    };
-
    if (!(await Install.limaInstalled())) {
-      await core.group('Installing lima', async () => {
-        await Exec.exec('brew', ['install', 'lima'], {env: envs});
-      });
+      await this.brewInstall('lima');
    }

    await core.group('Lima version', async () => {
-      await Exec.exec('lima', ['--version'], {env: envs});
+      await Exec.exec('lima', ['--version']);
    });

    await core.group('Creating lima config', async () => {
@@ -308,9 +303,7 @@ export class Install {
    });

    if (!(await Install.qemuInstalled())) {
-      await core.group('Installing QEMU', async () => {
-        await Exec.exec('brew', ['install', 'qemu'], {env: envs});
-      });
+      await this.brewInstall('qemu');
    }
    const qemuBin = await Install.qemuBin();
    await core.group('QEMU version', async () => {
@@ -319,14 +312,14 @@ export class Install {

    // lima might already be started on the runner so env var added in download
    // method is not expanded to the running process.
-    envs = Object.assign({}, envs, {
+    const envs = Object.assign({}, process.env, {
      PATH: `${this.toolDir}:${process.env.PATH}`
    }) as {
      [key: string]: string;
    };

    await core.group('Starting lima instance', async () => {
-      const limaStartArgs = ['start', `--name=${this.limaInstanceName}`];
+      const limaStartArgs = ['start', `--name=${this.limaInstanceName}`, `--timeout=${process.env.LIMA_START_TIMEOUT ?? '15m'}`];
      if (process.env.LIMA_START_ARGS) {
        limaStartArgs.push(process.env.LIMA_START_ARGS);
      }
@@ -418,7 +411,7 @@ export class Install {
        // avoid killing it when the action finishes running. Even if detached,
        // we also need to run dockerd in a subshell and unref the process so
        // GitHub Action doesn't wait for it to finish.
-        `${sudo} env "PATH=$PATH" ${bashPath} << EOF
+        `${sudo} env "PATH=$PATH" "XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR" ${bashPath} << EOF
 ( ${cmd} 2>&1 | tee "${this.runDir}/dockerd.log" ) &
 EOF`,
        [],
@@ -693,19 +686,17 @@ EOF`,
      });
  }

-  public static async getRelease(version: string): Promise<GitHubRelease> {
-    const url = `https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/docker-releases.json`;
-    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
-    const resp: httpm.HttpClientResponse = await http.get(url);
-    const body = await resp.readBody();
-    const statusCode = resp.message.statusCode || 500;
-    if (statusCode >= 400) {
-      throw new Error(`Failed to get Docker release ${version} from ${url} with status code ${statusCode}: ${body}`);
-    }
-    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+  public static async getRelease(version: string, githubToken?: string): Promise<GitHubRelease> {
+    const github = new GitHub({token: githubToken});
+    const releases = await github.releases('Docker', {
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/docker-releases.json'
+    });
    if (!releases[version]) {
      if (!releases['v' + version]) {
-        throw new Error(`Cannot find Docker release ${version} in ${url}`);
+        throw new Error(`Cannot find Docker release ${version} in releases JSON`);
      }
      return releases['v' + version];
    }
@@ -748,4 +739,72 @@ EOF`,
    });
    return <Image>JSON.parse(blob);
  }
+
+  private async brewInstall(packageName: string, revision?: string): Promise<void> {
+    // avoid brew to auto update and upgrade unrelated packages.
+    const envs = Object.assign({}, process.env, {
+      HOMEBREW_NO_AUTO_UPDATE: '1',
+      HOMEBREW_NO_INSTALL_UPGRADE: '1',
+      HOMEBREW_NO_INSTALL_CLEANUP: '1'
+    }) as {
+      [key: string]: string;
+    };
+
+    await core.group(`Installing ${packageName}`, async () => {
+      if (!revision) {
+        await Exec.exec('brew', ['install', packageName]);
+      } else {
+        const dockerTap = 'docker-actions-toolkit/tap';
+        const hasDockerTap = await Exec.getExecOutput('brew', ['tap'], {
+          ignoreReturnCode: true,
+          silent: true,
+          env: envs
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            throw new Error(res.stderr);
+          }
+          for (const line of res.stdout.trim().split('\n')) {
+            if (line.includes(dockerTap)) {
+              return true;
+            }
+          }
+          return false;
+        });
+        if (!hasDockerTap) {
+          await Exec.exec('brew', ['tap-new', dockerTap], {env: envs});
+        }
+        const brewRepoTapPath = await Exec.getExecOutput('brew', ['--repo', dockerTap], {
+          ignoreReturnCode: true,
+          silent: true,
+          env: envs
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            throw new Error(res.stderr);
+          }
+          return res.stdout.trim();
+        });
+        const formulaURL = `https://raw.githubusercontent.com/Homebrew/homebrew-core/${revision}/Formula/${packageName.charAt(0)}/${packageName}.rb`;
+        await tc.downloadTool(formulaURL, path.join(brewRepoTapPath, 'Formula', `${packageName}.rb`));
+        const hasFormulaInstalled = await Exec.getExecOutput('brew', ['ls', '-1'], {
+          ignoreReturnCode: true,
+          silent: true,
+          env: envs
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            throw new Error(res.stderr);
+          }
+          for (const line of res.stdout.trim().split('\n')) {
+            if (line.trim() == packageName) {
+              return true;
+            }
+          }
+          return false;
+        });
+        if (hasFormulaInstalled) {
+          await Exec.exec('brew', ['uninstall', packageName, '--ignore-dependencies'], {env: envs});
+        }
+        await Exec.exec('brew', ['install', `${dockerTap}/${packageName}`], {env: envs});
+      }
+    });
+  }
 }
--- a/src/git.ts
+++ b/src/git.ts
@@ -122,6 +122,11 @@ export class Git {

  private static async getDetachedRef(): Promise<string> {
    const res = await Git.exec(['show', '-s', '--pretty=%D']);
+    core.debug(`detached HEAD ref: ${res}`);
+
+    if (res === 'HEAD') {
+      return await Git.inferRefFromHead();
+    }

    // Can be "HEAD, <tagname>" or "grafted, HEAD, <tagname>"
    const refMatch = res.match(/^(grafted, )?HEAD, (.*)$/);
@@ -137,16 +142,22 @@ export class Git {
      return `refs/tags/${ref.split(':')[1].trim()}`;
    }

-    // Branch refs are formatted as "<origin>/<branch-name>, <branch-name>"
+    // Pull request merge refs are formatted as "pull/<number>/<state>"
+    const prMatch = ref.match(/^pull\/\d+\/(head|merge)$/);
+    if (prMatch) {
+      return `refs/${ref}`;
+    }
+
+    // Branch refs can be formatted as "<origin>/<branch-name>, <branch-name>"
    const branchMatch = ref.match(/^[^/]+\/[^/]+, (.+)$/);
    if (branchMatch) {
      return `refs/heads/${branchMatch[1].trim()}`;
    }

-    // Pull request merge refs are formatted as "pull/<number>/<state>"
-    const prMatch = ref.match(/^pull\/\d+\/(head|merge)$/);
-    if (prMatch) {
-      return `refs/${ref}`;
+    // Branch refs checked out by its latest SHA can be formatted as "<origin>/<branch-name>"
+    const shaBranchMatch = ref.match(/^[^/]+\/(.+)$/);
+    if (shaBranchMatch) {
+      return `refs/heads/${shaBranchMatch[1].trim()}`;
    }

    throw new Error(`Unsupported detached HEAD ref in "${res}"`);
@@ -164,6 +175,43 @@ export class Git {
    });
  }

+  private static async inferRefFromHead(): Promise<string> {
+    const localRef = await Git.findContainingRef('refs/heads/');
+    if (localRef) {
+      return localRef;
+    }
+
+    const remoteRef = await Git.findContainingRef('refs/remotes/');
+    if (remoteRef) {
+      const remoteMatch = remoteRef.match(/^refs\/remotes\/[^/]+\/(.+)$/);
+      if (remoteMatch) {
+        return `refs/heads/${remoteMatch[1]}`;
+      }
+      return remoteRef;
+    }
+
+    const tagRef = await Git.exec(['tag', '--contains', 'HEAD']);
+    const [firstTag] = tagRef
+      .split('\n')
+      .map(tag => tag.trim())
+      .filter(tag => tag.length > 0);
+    if (firstTag) {
+      return `refs/tags/${firstTag}`;
+    }
+
+    throw new Error(`Cannot infer ref from detached HEAD`);
+  }
+
+  private static async findContainingRef(scope: string): Promise<string | undefined> {
+    const refs = await Git.exec(['for-each-ref', '--format=%(refname)', '--contains', 'HEAD', '--sort=-committerdate', scope]);
+
+    const [first] = refs
+      .split('\n')
+      .map(r => r.trim())
+      .filter(r => r.length > 0);
+    return first;
+  }
+
  public static async commitDate(ref: string): Promise<Date> {
    return new Date(await Git.exec(['show', '-s', '--format="%ci"', ref]));
  }
--- a/src/github.ts
+++ b/src/github.ts
@@ -17,7 +17,7 @@
 import crypto from 'crypto';
 import fs from 'fs';
 import he from 'he';
-import jsyaml from 'js-yaml';
+import {dump as yamldump} from 'js-yaml';
 import os from 'os';
 import path from 'path';
 import {CreateArtifactRequest, FinalizeArtifactRequest, StringValue} from '@actions/artifact/lib/generated';
@@ -31,29 +31,62 @@ import {SummaryTableCell} from '@actions/core/lib/summary';
 import * as github from '@actions/github';
 import {GitHub as Octokit} from '@actions/github/lib/utils';
 import {Context} from '@actions/github/lib/context';
-import {TransferProgressEvent} from '@azure/core-http';
+import * as httpm from '@actions/http-client';
+import {TransferProgressEvent} from '@azure/core-rest-pipeline';
 import {BlobClient, BlobHTTPHeaders} from '@azure/storage-blob';
 import {jwtDecode, JwtPayload} from 'jwt-decode';

 import {Util} from './util';

-import {BuildSummaryOpts, GitHubActionsRuntimeToken, GitHubActionsRuntimeTokenAC, GitHubRepo, UploadArtifactOpts, UploadArtifactResponse} from './types/github';
+import {BuildSummaryOpts, GitHubActionsRuntimeToken, GitHubActionsRuntimeTokenAC, GitHubContentOpts, GitHubRelease, GitHubRepo, UploadArtifactOpts, UploadArtifactResponse} from './types/github';

 export interface GitHubOpts {
  token?: string;
 }

 export class GitHub {
+  private readonly githubToken?: string;
  public readonly octokit: InstanceType<typeof Octokit>;

  constructor(opts?: GitHubOpts) {
-    this.octokit = github.getOctokit(`${opts?.token}`);
+    this.githubToken = opts?.token || process.env.GITHUB_TOKEN;
+    this.octokit = github.getOctokit(`${this.githubToken}`);
  }

  public repoData(): Promise<GitHubRepo> {
    return this.octokit.rest.repos.get({...github.context.repo}).then(response => response.data as GitHubRepo);
  }

+  public async releases(name: string, opts: GitHubContentOpts): Promise<Record<string, GitHubRelease>> {
+    let releases: Record<string, GitHubRelease>;
+    try {
+      // try without token first
+      releases = await this.releasesRaw(name, opts);
+    } catch (error) {
+      if (!this.githubToken) {
+        throw error;
+      }
+      // try with token
+      releases = await this.releasesRaw(name, opts, this.githubToken);
+    }
+    return releases;
+  }
+
+  public async releasesRaw(name: string, opts: GitHubContentOpts, token?: string): Promise<Record<string, GitHubRelease>> {
+    const url = `https://raw.githubusercontent.com/${opts.owner}/${opts.repo}/${opts.ref}/${opts.path}`;
+    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
+    // prettier-ignore
+    const httpResp: httpm.HttpClientResponse = await http.get(url, token ? {
+      Authorization: `token ${token}`
+    } : undefined);
+    const dt = await httpResp.readBody();
+    const statusCode = httpResp.message.statusCode || 500;
+    if (statusCode >= 400) {
+      throw new Error(`Failed to get ${name} releases from ${url} with status code ${statusCode}: ${dt}`);
+    }
+    return <Record<string, GitHubRelease>>JSON.parse(dt);
+  }
+
  static get context(): Context {
    return github.context;
  }
@@ -233,10 +266,24 @@ export class GitHub {
      return `<a href="${url}">${text}</a>` + (addEOL ? os.EOL : '');
    };

-    const refsSize = Object.keys(opts.exportRes.refs).length;
+    const refsSize = opts.exportRes.refs.length;
+    const firstRef = refsSize > 0 ? opts.exportRes.refs?.[0] : undefined;
+    const firstSummary = firstRef ? opts.exportRes.summaries?.[firstRef] : undefined;
+    const dbcAccount = opts.driver === 'cloud' && opts.endpoint ? opts.endpoint?.replace(/^cloud:\/\//, '').split('/')[0] : undefined;

    const sum = core.summary.addHeading('Docker Build summary', 2);

+    if (dbcAccount && refsSize === 1 && firstRef && firstSummary) {
+      const buildURL = GitHub.formatDBCBuildURL(dbcAccount, firstRef, firstSummary.defaultPlatform);
+      // prettier-ignore
+      sum.addRaw(`<p>`)
+        .addRaw(`For a detailed look at the build, you can check the results at:`)
+      .addRaw('</p>')
+      .addRaw(`<p>`)
+        .addRaw(`:whale: ${addLink(`<strong>${buildURL}</strong>`, buildURL)}`)
+      .addRaw(`</p>`);
+    }
+
    if (opts.uploadRes) {
      // we just need the last two parts of the URL as they are always relative
      // to the workflow run URL otherwise URL could be broken if GitHub
@@ -246,17 +293,29 @@ export class GitHub {
      // https://github.com/docker/actions-toolkit/issues/367
      const artifactRelativeURL = `./${GitHub.runId}/${opts.uploadRes.url.split('/').slice(-2).join('/')}`;

+      if (dbcAccount && refsSize === 1) {
+        // prettier-ignore
+        sum.addRaw(`<p>`)
+          .addRaw(`You can also download the following build record archive and import it into Docker Desktop's Builds view. `)
+          .addBreak()
+          .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
+          .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
+        .addRaw('</p>')
+      } else {
+        // prettier-ignore
+        sum.addRaw(`<p>`)
+          .addRaw(`For a detailed look at the build, download the following build record archive and import it into Docker Desktop's Builds view. `)
+          .addBreak()
+          .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
+          .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
+        .addRaw('</p>')
+      }
+
      // prettier-ignore
      sum.addRaw(`<p>`)
-        .addRaw(`For a detailed look at the build, download the following build record archive and import it into Docker Desktop's Builds view. `)
-        .addBreak()
-        .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
-        .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
-      .addRaw('</p>')
-      .addRaw(`<p>`)
        .addRaw(`:arrow_down: ${addLink(`<strong>${Util.stringToUnicodeEntities(opts.uploadRes.filename)}</strong>`, artifactRelativeURL)} (${Util.formatFileSize(opts.uploadRes.size)} - includes <strong>${refsSize} build record${refsSize > 1 ? 's' : ''}</strong>)`)
      .addRaw(`</p>`);
-    } else {
+    } else if (opts.exportRes.summaries) {
      // prettier-ignore
      sum.addRaw(`<p>`)
        .addRaw(`The following table provides a brief summary of your build.`)
@@ -273,12 +332,14 @@ export class GitHub {
      // Preview
      sum.addRaw('<p>');
      const summaryTableData: Array<Array<SummaryTableCell>> = [
+        // prettier-ignore
        [
          {header: true, data: 'ID'},
          {header: true, data: 'Name'},
          {header: true, data: 'Status'},
          {header: true, data: 'Cached'},
-          {header: true, data: 'Duration'}
+          {header: true, data: 'Duration'},
+          ...(dbcAccount && refsSize > 1 ? [{header: true, data: 'Build result URL'}] : [])
        ]
      ];
      let buildError: string | undefined;
@@ -287,12 +348,13 @@ export class GitHub {
          const summary = opts.exportRes.summaries[ref];
          // prettier-ignore
          summaryTableData.push([
-          {data: `<code>${ref.substring(0, 6).toUpperCase()}</code>`},
-          {data: `<strong>${Util.stringToUnicodeEntities(summary.name)}</strong>`},
-          {data: `${summary.status === 'completed' ? ':white_check_mark:' : summary.status === 'canceled' ? ':no_entry_sign:' : ':x:'} ${summary.status}`},
-          {data: `${summary.numCachedSteps > 0 ? Math.round((summary.numCachedSteps / summary.numTotalSteps) * 100) : 0}%`},
-          {data: summary.duration}
-        ]);
+            {data: `<code>${ref.substring(0, 6).toUpperCase()}</code>`},
+            {data: `<strong>${Util.stringToUnicodeEntities(summary.name)}</strong>`},
+            {data: `${summary.status === 'completed' ? ':white_check_mark:' : summary.status === 'canceled' ? ':no_entry_sign:' : ':x:'} ${summary.status}`},
+            {data: `${summary.numCachedSteps > 0 ? Math.round((summary.numCachedSteps / summary.numTotalSteps) * 100) : 0}%`},
+            {data: summary.duration},
+            ...(dbcAccount && refsSize > 1 ? [{data: addLink(':whale: Open', GitHub.formatDBCBuildURL(dbcAccount, ref, summary.defaultPlatform))}] : [])
+          ]);
          if (summary.error) {
            buildError = summary.error;
          }
@@ -328,7 +390,7 @@ export class GitHub {
      // prettier-ignore
      sum.addRaw(`<details><summary><strong>Build inputs</strong></summary>`)
        .addCodeBlock(
-          jsyaml.dump(opts.inputs, {
+          yamldump(opts.inputs, {
            indent: 2,
            lineWidth: -1
          }), 'yaml'
@@ -347,4 +409,8 @@ export class GitHub {
    core.info(`Writing summary`);
    await sum.addSeparator().write();
  }
+
+  private static formatDBCBuildURL(account: string, ref: string, platform?: string): string {
+    return `https://app.docker.com/build/accounts/${account}/builds/${(platform ?? 'linux/amd64').replace('/', '-')}/${ref}`;
+  }
 }
--- a/src/regclient/install.ts
+++ b/src/regclient/install.ts
@@ -18,18 +18,28 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
 import * as tc from '@actions/tool-cache';
 import * as semver from 'semver';
 import * as util from 'util';

 import {Cache} from '../cache';
 import {Context} from '../context';
+import {GitHub} from '../github';

 import {GitHubRelease} from '../types/github';
 import {DownloadVersion} from '../types/regclient/regclient';

+export interface InstallOpts {
+  githubToken?: string;
+}
+
 export class Install {
+  private readonly githubToken: string | undefined;
+
+  constructor(opts?: InstallOpts) {
+    this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
+  }
+
  /*
   * Download regclient binary from GitHub release
   * @param v: version semver version or latest
@@ -40,7 +50,7 @@ export class Install {
    const version: DownloadVersion = await Install.getDownloadVersion(v);
    core.debug(`Install.download version: ${version.version}`);

-    const release: GitHubRelease = await Install.getRelease(version);
+    const release: GitHubRelease = await Install.getRelease(version, this.githubToken);
    core.debug(`Install.download release tag name: ${release.tag_name}`);

    const vspec = await this.vspec(release.tag_name);
@@ -68,7 +78,7 @@ export class Install {
    const downloadURL = util.format(version.downloadURL, vspec, this.filename());
    core.info(`Downloading ${downloadURL}`);

-    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    const htcDownloadPath = await tc.downloadTool(downloadURL, undefined, this.githubToken);
    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);

    const cacheSavePath = await installCache.save(htcDownloadPath);
@@ -134,21 +144,20 @@ export class Install {
    return {
      version: v,
      downloadURL: 'https://github.com/regclient/regclient/releases/download/v%s/%s',
-      releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json'
+      contentOpts: {
+        owner: 'docker',
+        repo: 'actions-toolkit',
+        ref: 'main',
+        path: '.github/regclient-releases.json'
+      }
    };
  }

-  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
-    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
-    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
-    const body = await resp.readBody();
-    const statusCode = resp.message.statusCode || 500;
-    if (statusCode >= 400) {
-      throw new Error(`Failed to get regclient releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
-    }
-    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+  public static async getRelease(version: DownloadVersion, githubToken?: string): Promise<GitHubRelease> {
+    const github = new GitHub({token: githubToken});
+    const releases = await github.releases('regclient', version.contentOpts);
    if (!releases[version.version]) {
-      throw new Error(`Cannot find regclient release ${version.version} in ${version.releasesURL}`);
+      throw new Error(`Cannot find regclient release ${version.version} in releases JSON`);
    }
    return releases[version.version];
  }
--- a/src/sigstore/sigstore.ts
+++ b/src/sigstore/sigstore.ts
@@ -0,0 +1,391 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {X509Certificate} from 'crypto';
+import fs from 'fs';
+import path from 'path';
+
+import * as core from '@actions/core';
+import {bundleFromJSON, bundleToJSON} from '@sigstore/bundle';
+import {Artifact, Bundle, CIContextProvider, DSSEBundleBuilder, FulcioSigner, RekorWitness, TSAWitness, Witness} from '@sigstore/sign';
+
+import {Cosign} from '../cosign/cosign';
+import {Exec} from '../exec';
+import {GitHub} from '../github';
+import {ImageTools} from '../buildx/imagetools';
+
+import {MEDIATYPE_PAYLOAD as INTOTO_MEDIATYPE_PAYLOAD, Subject} from '../types/intoto/intoto';
+import {
+  Endpoints,
+  FULCIO_URL,
+  ParsedBundle,
+  REKOR_URL,
+  SEARCH_URL,
+  SignAttestationManifestsOpts,
+  SignAttestationManifestsResult,
+  SignProvenanceBlobsOpts,
+  SignProvenanceBlobsResult,
+  TSASERVER_URL,
+  VerifySignedArtifactsOpts,
+  VerifySignedArtifactsResult,
+  VerifySignedManifestsOpts,
+  VerifySignedManifestsResult
+} from '../types/sigstore/sigstore';
+
+export interface SigstoreOpts {
+  cosign?: Cosign;
+  imageTools?: ImageTools;
+}
+
+export class Sigstore {
+  private readonly cosign: Cosign;
+  private readonly imageTools: ImageTools;
+
+  constructor(opts?: SigstoreOpts) {
+    this.cosign = opts?.cosign || new Cosign();
+    this.imageTools = opts?.imageTools || new ImageTools();
+  }
+
+  public async signAttestationManifests(opts: SignAttestationManifestsOpts): Promise<Record<string, SignAttestationManifestsResult>> {
+    if (!(await this.cosign.isAvailable())) {
+      throw new Error('Cosign is required to sign attestation manifests');
+    }
+    const result: Record<string, SignAttestationManifestsResult> = {};
+    try {
+      if (!process.env.ACTIONS_ID_TOKEN_REQUEST_URL) {
+        throw new Error('missing "id-token" permission. Please add "permissions: id-token: write" to your workflow.');
+      }
+
+      const endpoints = this.signingEndpoints(opts.noTransparencyLog);
+      core.info(`Using Sigstore signing endpoint: ${endpoints.fulcioURL}`);
+      const noTransparencyLog = Sigstore.noTransparencyLog(opts.noTransparencyLog);
+
+      for (const imageName of opts.imageNames) {
+        const attestationDigests = await this.imageTools.attestationDigests(`${imageName}@${opts.imageDigest}`);
+        for (const attestationDigest of attestationDigests) {
+          const attestationRef = `${imageName}@${attestationDigest}`;
+          await core.group(`Signing attestation manifest ${attestationRef}`, async () => {
+            // prettier-ignore
+            const cosignArgs = [
+            'sign',
+            '--yes',
+            '--oidc-provider', 'github-actions',
+            '--registry-referrers-mode', 'oci-1-1',
+            '--new-bundle-format',
+            '--use-signing-config'
+          ];
+            if (noTransparencyLog) {
+              cosignArgs.push('--tlog-upload=false');
+            }
+            core.info(`[command]cosign ${[...cosignArgs, attestationRef].join(' ')}`);
+            const execRes = await Exec.getExecOutput('cosign', ['--verbose', ...cosignArgs, attestationRef], {
+              ignoreReturnCode: true,
+              silent: true,
+              env: Object.assign({}, process.env, {
+                COSIGN_EXPERIMENTAL: '1'
+              }) as {
+                [key: string]: string;
+              }
+            });
+            const signResult = Cosign.parseCommandOutput(execRes.stderr.trim());
+            if (execRes.exitCode != 0) {
+              if (signResult.errors && signResult.errors.length > 0) {
+                const errorMessages = signResult.errors.map(e => `- [${e.code}] ${e.message} : ${e.detail}`).join('\n');
+                throw new Error(`Cosign sign command failed with errors:\n${errorMessages}`);
+              } else {
+                throw new Error(`Cosign sign command failed with exit code ${execRes.exitCode}`);
+              }
+            }
+            const parsedBundle = Sigstore.parseBundle(bundleFromJSON(signResult.bundle));
+            if (parsedBundle.tlogID) {
+              core.info(`Uploaded to Rekor transparency log: ${SEARCH_URL}?logIndex=${parsedBundle.tlogID}`);
+            }
+            core.info(`Signature manifest pushed: https://oci.dag.dev/?referrers=${attestationRef}`);
+            result[attestationRef] = {
+              ...parsedBundle,
+              imageName: imageName
+            };
+          });
+        }
+      }
+    } catch (err) {
+      throw new Error(`Signing BuildKit attestation manifests failed: ${(err as Error).message}`);
+    }
+    return result;
+  }
+
+  public async verifySignedManifests(opts: VerifySignedManifestsOpts, signed: Record<string, SignAttestationManifestsResult>): Promise<Record<string, VerifySignedManifestsResult>> {
+    const result: Record<string, VerifySignedManifestsResult> = {};
+    const retries = opts.retries ?? 15;
+
+    if (!(await this.cosign.isAvailable())) {
+      throw new Error('Cosign is required to verify signed manifests');
+    }
+
+    let lastError: Error | undefined;
+    for (const [attestationRef, signedRes] of Object.entries(signed)) {
+      await core.group(`Verifying signature of ${attestationRef}`, async () => {
+        // prettier-ignore
+        const cosignArgs = [
+          'verify',
+          '--experimental-oci11',
+          '--new-bundle-format',
+          '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
+          '--certificate-identity-regexp', opts.certificateIdentityRegexp
+        ];
+        if (!signedRes.tlogID) {
+          // skip tlog verification but still verify the signed timestamp
+          cosignArgs.push('--use-signed-timestamps', '--insecure-ignore-tlog');
+        }
+        core.info(`[command]cosign ${[...cosignArgs, attestationRef].join(' ')}`);
+        for (let attempt = 0; attempt < retries; attempt++) {
+          const execRes = await Exec.getExecOutput('cosign', ['--verbose', ...cosignArgs, attestationRef], {
+            ignoreReturnCode: true,
+            silent: true,
+            env: Object.assign({}, process.env, {
+              COSIGN_EXPERIMENTAL: '1'
+            }) as {[key: string]: string}
+          });
+          const verifyResult = Cosign.parseCommandOutput(execRes.stderr.trim());
+          if (execRes.exitCode === 0) {
+            result[attestationRef] = {
+              cosignArgs: cosignArgs,
+              signatureManifestDigest: verifyResult.signatureManifestDigest!
+            };
+            lastError = undefined;
+            core.info(`Signature manifest verified: https://oci.dag.dev/?image=${signedRes.imageName}@${verifyResult.signatureManifestDigest}`);
+            break;
+          } else {
+            if (verifyResult.errors && verifyResult.errors.length > 0) {
+              const errorMessages = verifyResult.errors.map(e => `- [${e.code}] ${e.message} : ${e.detail}`).join('\n');
+              lastError = new Error(`Cosign verify command failed with errors:\n${errorMessages}`);
+              if (verifyResult.errors.some(e => e.code === 'MANIFEST_UNKNOWN')) {
+                core.info(`Cosign verify command failed with MANIFEST_UNKNOWN, retrying attempt ${attempt + 1}/${retries}...\n${errorMessages}`);
+                await new Promise(res => setTimeout(res, Math.pow(2, attempt) * 100));
+              } else {
+                throw lastError;
+              }
+            } else {
+              throw new Error(`Cosign verify command failed: ${execRes.stderr}`);
+            }
+          }
+        }
+      });
+    }
+    if (lastError) {
+      throw lastError;
+    }
+
+    return result;
+  }
+
+  public async signProvenanceBlobs(opts: SignProvenanceBlobsOpts): Promise<Record<string, SignProvenanceBlobsResult>> {
+    const result: Record<string, SignProvenanceBlobsResult> = {};
+    try {
+      if (!process.env.ACTIONS_ID_TOKEN_REQUEST_URL) {
+        throw new Error('missing "id-token" permission. Please add "permissions: id-token: write" to your workflow.');
+      }
+
+      const endpoints = this.signingEndpoints(opts.noTransparencyLog);
+      core.info(`Using Sigstore signing endpoint: ${endpoints.fulcioURL}`);
+
+      const provenanceBlobs = Sigstore.getProvenanceBlobs(opts);
+      for (const p of Object.keys(provenanceBlobs)) {
+        await core.group(`Signing ${p}`, async () => {
+          const blob = provenanceBlobs[p];
+          const bundlePath = path.join(path.dirname(p), `${opts.name ?? 'provenance'}.sigstore.json`);
+          const subjects = Sigstore.getProvenanceSubjects(blob);
+          if (subjects.length === 0) {
+            core.warning(`No subjects found in provenance ${p}, skip signing.`);
+            return;
+          }
+          const bundle = await Sigstore.signPayload(
+            {
+              data: blob,
+              type: INTOTO_MEDIATYPE_PAYLOAD
+            },
+            endpoints
+          );
+          const parsedBundle = Sigstore.parseBundle(bundle);
+          core.info(`Provenance blob signed for:`);
+          for (const subject of subjects) {
+            const [digestAlg, digestValue] = Object.entries(subject.digest)[0] || [];
+            core.info(`  - ${subject.name} (${digestAlg}:${digestValue})`);
+          }
+          if (parsedBundle.tlogID) {
+            core.info(`Attestation signature uploaded to Rekor transparency log: ${SEARCH_URL}?logIndex=${parsedBundle.tlogID}`);
+          }
+          core.info(`Writing Sigstore bundle to: ${bundlePath}`);
+          fs.writeFileSync(bundlePath, JSON.stringify(parsedBundle.payload, null, 2), {
+            encoding: 'utf-8'
+          });
+          result[p] = {
+            ...parsedBundle,
+            bundlePath: bundlePath,
+            subjects: subjects
+          };
+        });
+      }
+    } catch (err) {
+      throw new Error(`Signing BuildKit provenance blobs failed: ${(err as Error).message}`);
+    }
+    return result;
+  }
+
+  public async verifySignedArtifacts(opts: VerifySignedArtifactsOpts, signed: Record<string, SignProvenanceBlobsResult>): Promise<Record<string, VerifySignedArtifactsResult>> {
+    const result: Record<string, VerifySignedArtifactsResult> = {};
+    if (!(await this.cosign.isAvailable())) {
+      throw new Error('Cosign is required to verify signed artifacts');
+    }
+    for (const [provenancePath, signedRes] of Object.entries(signed)) {
+      const baseDir = path.dirname(provenancePath);
+      await core.group(`Verifying signature bundle ${signedRes.bundlePath}`, async () => {
+        for (const subject of signedRes.subjects) {
+          const artifactPath = path.join(baseDir, subject.name);
+          core.info(`Verifying signed artifact ${artifactPath}`);
+          // prettier-ignore
+          const cosignArgs = [
+            'verify-blob-attestation',
+            '--new-bundle-format',
+            '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
+            '--certificate-identity-regexp', opts.certificateIdentityRegexp
+          ]
+          if (!signedRes.tlogID) {
+            // if there is no tlog entry, we skip tlog verification but still verify the signed timestamp
+            cosignArgs.push('--use-signed-timestamps', '--insecure-ignore-tlog');
+          }
+          const execRes = await Exec.getExecOutput('cosign', [...cosignArgs, '--bundle', signedRes.bundlePath, artifactPath], {
+            ignoreReturnCode: true
+          });
+          if (execRes.stderr.length > 0 && execRes.exitCode != 0) {
+            throw new Error(execRes.stderr);
+          }
+          result[artifactPath] = {
+            bundlePath: signedRes.bundlePath,
+            cosignArgs: cosignArgs
+          };
+        }
+      });
+    }
+    return result;
+  }
+
+  private signingEndpoints(noTransparencyLog?: boolean): Endpoints {
+    noTransparencyLog = Sigstore.noTransparencyLog(noTransparencyLog);
+    core.info(`Upload to transparency log: ${noTransparencyLog ? 'disabled' : 'enabled'}`);
+    return {
+      fulcioURL: FULCIO_URL,
+      rekorURL: noTransparencyLog ? undefined : REKOR_URL,
+      tsaServerURL: TSASERVER_URL
+    };
+  }
+
+  private static noTransparencyLog(noTransparencyLog?: boolean): boolean {
+    return noTransparencyLog ?? GitHub.context.payload.repository?.private;
+  }
+
+  private static getProvenanceBlobs(opts: SignProvenanceBlobsOpts): Record<string, Buffer> {
+    // For single platform build
+    const singleProvenance = path.join(opts.localExportDir, 'provenance.json');
+    if (fs.existsSync(singleProvenance)) {
+      return {[singleProvenance]: fs.readFileSync(singleProvenance)};
+    }
+
+    // For multi-platform build
+    const dirents = fs.readdirSync(opts.localExportDir, {withFileTypes: true});
+    const platformFolders = dirents.filter(dirent => dirent.isDirectory());
+    if (platformFolders.length > 0 && platformFolders.length === dirents.length && platformFolders.every(platformFolder => fs.existsSync(path.join(opts.localExportDir, platformFolder.name, 'provenance.json')))) {
+      const result: Record<string, Buffer> = {};
+      for (const platformFolder of platformFolders) {
+        const p = path.join(opts.localExportDir, platformFolder.name, 'provenance.json');
+        result[p] = fs.readFileSync(p);
+      }
+      return result;
+    }
+
+    throw new Error(`No valid provenance.json found in ${opts.localExportDir}`);
+  }
+
+  private static getProvenanceSubjects(body: Buffer): Array<Subject> {
+    const statement = JSON.parse(body.toString()) as {
+      subject: Array<{name: string; digest: Record<string, string>}>;
+    };
+    return statement.subject.map(s => ({
+      name: s.name,
+      digest: s.digest
+    }));
+  }
+
+  private static async signPayload(artifact: Artifact, endpoints: Endpoints, timeout?: number, retries?: number): Promise<Bundle> {
+    const witnesses: Witness[] = [];
+
+    const signer = new FulcioSigner({
+      identityProvider: new CIContextProvider('sigstore'),
+      fulcioBaseURL: endpoints.fulcioURL,
+      timeout: timeout,
+      retry: retries
+    });
+
+    if (endpoints.rekorURL) {
+      witnesses.push(
+        new RekorWitness({
+          rekorBaseURL: endpoints.rekorURL,
+          fetchOnConflict: true,
+          timeout: timeout,
+          retry: retries
+        })
+      );
+    }
+
+    if (endpoints.tsaServerURL) {
+      witnesses.push(
+        new TSAWitness({
+          tsaBaseURL: endpoints.tsaServerURL,
+          timeout: timeout,
+          retry: retries
+        })
+      );
+    }
+
+    return new DSSEBundleBuilder({signer, witnesses}).create(artifact);
+  }
+
+  private static parseBundle(bundle: Bundle): ParsedBundle {
+    let certBytes: Buffer;
+    switch (bundle.verificationMaterial.content.$case) {
+      case 'x509CertificateChain':
+        certBytes = bundle.verificationMaterial.content.x509CertificateChain.certificates[0].rawBytes;
+        break;
+      case 'certificate':
+        certBytes = bundle.verificationMaterial.content.certificate.rawBytes;
+        break;
+      default:
+        throw new Error('Bundle must contain an x509 certificate');
+    }
+
+    const signingCert = new X509Certificate(certBytes);
+
+    // collect transparency log ID if available
+    const tlogEntries = bundle.verificationMaterial.tlogEntries;
+    const tlogID = tlogEntries.length > 0 ? tlogEntries[0].logIndex : undefined;
+
+    return {
+      payload: bundleToJSON(bundle),
+      certificate: signingCert.toString(),
+      tlogID: tlogID
+    };
+  }
+}
--- a/src/toolkit.ts
+++ b/src/toolkit.ts
@@ -14,6 +14,7 @@
 * limitations under the License.
 */

+import {GitHub} from './github';
 import {Buildx} from './buildx/buildx';
 import {Build as BuildxBuild} from './buildx/build';
 import {Bake as BuildxBake} from './buildx/bake';
@@ -22,8 +23,13 @@ import {Builder} from './buildx/builder';
 import {BuildKit} from './buildkit/buildkit';
 import {Compose} from './compose/compose';
 import {Install as ComposeInstall} from './compose/install';
+import {Cosign} from './cosign/cosign';
+import {Install as CosignInstall} from './cosign/install';
+import {Regctl} from './regclient/regctl';
+import {Install as RegctlInstall} from './regclient/install';
 import {Undock} from './undock/undock';
-import {GitHub} from './github';
+import {Install as UndockInstall} from './undock/install';
+import {Sigstore} from './sigstore/sigstore';

 export interface ToolkitOpts {
  /**
@@ -43,7 +49,13 @@ export class Toolkit {
  public buildkit: BuildKit;
  public compose: Compose;
  public composeInstall: ComposeInstall;
+  public cosign: Cosign;
+  public cosignInstall: CosignInstall;
+  public regctl: Regctl;
+  public regctlInstall: RegctlInstall;
+  public sigstore: Sigstore;
  public undock: Undock;
+  public undockInstall: UndockInstall;

  constructor(opts: ToolkitOpts = {}) {
    this.github = new GitHub({token: opts.githubToken});
@@ -55,6 +67,12 @@ export class Toolkit {
    this.buildkit = new BuildKit({buildx: this.buildx});
    this.compose = new Compose();
    this.composeInstall = new ComposeInstall();
+    this.cosign = new Cosign();
+    this.cosignInstall = new CosignInstall({buildx: this.buildx});
+    this.regctl = new Regctl();
+    this.regctlInstall = new RegctlInstall();
+    this.sigstore = new Sigstore();
    this.undock = new Undock();
+    this.undockInstall = new UndockInstall();
  }
 }
--- a/src/types/buildx/buildx.ts
+++ b/src/types/buildx/buildx.ts
@@ -14,6 +14,8 @@
 * limitations under the License.
 */

+import {GitHubContentOpts} from '../github';
+
 export interface Cert {
  cacert?: string;
  cert?: string;
@@ -24,7 +26,7 @@ export interface DownloadVersion {
  key: string;
  version: string;
  downloadURL: string;
-  releasesURL: string;
+  contentOpts: GitHubContentOpts;
 }

 export interface LocalRefsOpts {
--- a/src/types/buildx/history.ts
+++ b/src/types/buildx/history.ts
@@ -131,5 +131,6 @@ export interface Summary {
  numTotalSteps: number;
  numCompletedSteps: number;
  frontendAttrs?: Record<string, string>;
+  defaultPlatform?: string;
  error?: string;
 }
--- a/src/types/buildx/imagetools.ts
+++ b/src/types/buildx/imagetools.ts
@@ -0,0 +1,28 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {Versioned} from '../oci/versioned';
+import {Descriptor} from '../oci/descriptor';
+import {Digest} from '../oci/digest';
+
+// https://github.com/docker/buildx/blob/62857022a08552bee5cad0c3044a9a3b185f0b32/util/imagetools/printers.go#L109-L123
+export interface Manifest extends Versioned {
+  mediaType?: string;
+  digest: Digest;
+  size: number;
+  manifests?: Descriptor[];
+  annotations?: Record<string, string>;
+}
--- a/src/types/compose/compose.ts
+++ b/src/types/compose/compose.ts
@@ -14,9 +14,11 @@
 * limitations under the License.
 */

+import {GitHubContentOpts} from '../github';
+
 export interface DownloadVersion {
  key: string;
  version: string;
  downloadURL: string;
-  releasesURL: string;
+  contentOpts: GitHubContentOpts;
 }
--- a/src/types/cosign/cosign.ts
+++ b/src/types/cosign/cosign.ts
@@ -0,0 +1,23 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {GitHubContentOpts} from '../github';
+
+export interface DownloadVersion {
+  version: string;
+  downloadURL: string;
+  contentOpts: GitHubContentOpts;
+}
--- a/src/types/docker/docker.ts
+++ b/src/types/docker/docker.ts
@@ -69,7 +69,6 @@ export interface ContextInfo {
  Name: string;
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  Metadata: any;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  Endpoints: Record<string, EndpointInfo>;
  TLSMaterial: Record<string, Array<string>>;
  Storage: StorageInfo;
--- a/src/types/github.ts
+++ b/src/types/github.ts
@@ -28,6 +28,13 @@ export interface GitHubRelease {
  assets: Array<string>;
 }

+export interface GitHubContentOpts {
+  owner: string;
+  repo: string;
+  ref?: string;
+  path: string;
+}
+
 export type GitHubRepo = OctoOpenApiTypes['schemas']['repository'];

 export interface GitHubActionsRuntimeToken extends JwtPayload {
@@ -62,4 +69,7 @@ export interface BuildSummaryOpts {
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  inputs?: any;
  bakeDefinition?: BakeDefinition;
+  // builder options
+  driver?: string;
+  endpoint?: string;
 }
--- a/src/types/intoto/intoto.ts
+++ b/src/types/intoto/intoto.ts
@@ -18,3 +18,9 @@
 export const MEDIATYPE_PAYLOAD = 'application/vnd.in-toto+json';

 export const MEDIATYPE_PREDICATE = 'in-toto.io/predicate-type';
+
+// https://github.com/in-toto/in-toto-golang/blob/0a34c087cedcc36de065b4fccb7cf7c9bc16e29f/in_toto/attestations.go#L30-L42
+export interface Subject {
+  name: string;
+  digest: Record<string, string>;
+}
--- a/src/types/regclient/regclient.ts
+++ b/src/types/regclient/regclient.ts
@@ -14,8 +14,10 @@
 * limitations under the License.
 */

+import {GitHubContentOpts} from '../github';
+
 export interface DownloadVersion {
  version: string;
  downloadURL: string;
-  releasesURL: string;
+  contentOpts: GitHubContentOpts;
 }
--- a/src/types/sigstore/sigstore.ts
+++ b/src/types/sigstore/sigstore.ts
@@ -0,0 +1,76 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type {SerializedBundle} from '@sigstore/bundle';
+
+import {Subject} from '../intoto/intoto';
+
+export const FULCIO_URL = 'https://fulcio.sigstore.dev';
+export const REKOR_URL = 'https://rekor.sigstore.dev';
+export const TSASERVER_URL = 'https://timestamp.sigstore.dev';
+export const SEARCH_URL = 'https://search.sigstore.dev';
+
+export interface Endpoints {
+  fulcioURL: string;
+  rekorURL?: string;
+  tsaServerURL?: string;
+}
+
+export interface ParsedBundle {
+  payload: SerializedBundle;
+  certificate: string;
+  tlogID?: string;
+}
+
+export interface SignAttestationManifestsOpts {
+  imageNames: Array<string>;
+  imageDigest: string;
+  noTransparencyLog?: boolean;
+}
+
+export interface SignAttestationManifestsResult extends ParsedBundle {
+  imageName: string;
+}
+
+export interface VerifySignedManifestsOpts {
+  certificateIdentityRegexp: string;
+  retries?: number;
+}
+
+export interface VerifySignedManifestsResult {
+  cosignArgs: Array<string>;
+  signatureManifestDigest: string;
+}
+
+export interface SignProvenanceBlobsOpts {
+  localExportDir: string;
+  name?: string;
+  noTransparencyLog?: boolean;
+}
+
+export interface SignProvenanceBlobsResult extends ParsedBundle {
+  bundlePath: string;
+  subjects: Array<Subject>;
+}
+
+export interface VerifySignedArtifactsOpts {
+  certificateIdentityRegexp: string;
+}
+
+export interface VerifySignedArtifactsResult {
+  bundlePath: string;
+  cosignArgs: Array<string>;
+}
--- a/src/types/undock/undock.ts
+++ b/src/types/undock/undock.ts
@@ -14,8 +14,10 @@
 * limitations under the License.
 */

+import {GitHubContentOpts} from '../github';
+
 export interface DownloadVersion {
  version: string;
  downloadURL: string;
-  releasesURL: string;
+  contentOpts: GitHubContentOpts;
 }
--- a/src/undock/install.ts
+++ b/src/undock/install.ts
@@ -18,18 +18,28 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
 import * as tc from '@actions/tool-cache';
 import * as semver from 'semver';
 import * as util from 'util';

 import {Cache} from '../cache';
 import {Context} from '../context';
+import {GitHub} from '../github';

 import {GitHubRelease} from '../types/github';
 import {DownloadVersion} from '../types/undock/undock';

+export interface InstallOpts {
+  githubToken?: string;
+}
+
 export class Install {
+  private readonly githubToken: string | undefined;
+
+  constructor(opts?: InstallOpts) {
+    this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
+  }
+
  /*
   * Download undock binary from GitHub release
   * @param v: version semver version or latest
@@ -40,7 +50,7 @@ export class Install {
    const version: DownloadVersion = await Install.getDownloadVersion(v);
    core.debug(`Install.download version: ${version.version}`);

-    const release: GitHubRelease = await Install.getRelease(version);
+    const release: GitHubRelease = await Install.getRelease(version, this.githubToken);
    core.debug(`Install.download release tag name: ${release.tag_name}`);

    const vspec = await this.vspec(release.tag_name);
@@ -61,14 +71,14 @@ export class Install {

    const cacheFoundPath = await installCache.find();
    if (cacheFoundPath) {
-      core.info(`Unodck binary found in ${cacheFoundPath}`);
+      core.info(`Undock binary found in ${cacheFoundPath}`);
      return cacheFoundPath;
    }

    const downloadURL = util.format(version.downloadURL, vspec, this.filename(vspec));
    core.info(`Downloading ${downloadURL}`);

-    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    const htcDownloadPath = await tc.downloadTool(downloadURL, undefined, this.githubToken);
    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);

    let htcExtPath: string;
@@ -102,7 +112,7 @@ export class Install {
    fs.chmodSync(undockPath, '0755');

    core.addPath(binDir);
-    core.info('Added Unodck to PATH');
+    core.info('Added Undock to PATH');

    core.info(`Binary path: ${undockPath}`);
    return undockPath;
@@ -145,21 +155,20 @@ export class Install {
    return {
      version: v,
      downloadURL: 'https://github.com/crazy-max/undock/releases/download/v%s/%s',
-      releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json'
+      contentOpts: {
+        owner: 'docker',
+        repo: 'actions-toolkit',
+        ref: 'main',
+        path: '.github/undock-releases.json'
+      }
    };
  }

-  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
-    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
-    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
-    const body = await resp.readBody();
-    const statusCode = resp.message.statusCode || 500;
-    if (statusCode >= 400) {
-      throw new Error(`Failed to get Undock releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
-    }
-    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+  public static async getRelease(version: DownloadVersion, githubToken?: string): Promise<GitHubRelease> {
+    const github = new GitHub({token: githubToken});
+    const releases = await github.releases('Undock', version.contentOpts);
    if (!releases[version.version]) {
-      throw new Error(`Cannot find Undock release ${version.version} in ${version.releasesURL}`);
+      throw new Error(`Cannot find Undock release ${version.version} in releases JSON`);
    }
    return releases[version.version];
  }
--- a/src/util.ts
+++ b/src/util.ts
@@ -82,7 +82,7 @@ export class Util {
    let url;
    try {
      url = new URL(urlStr);
-    } catch (e) {
+    } catch {
      return false;
    }
    return url.protocol === 'http:' || url.protocol === 'https:';
@@ -115,10 +115,10 @@ export class Util {
    };
  }

-  public static isDirectory(p) {
+  public static isDirectory(p: string) {
    try {
      return fs.lstatSync(p).isDirectory();
-    } catch (_) {
+    } catch {
      // noop
    }
    return false;
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -18,7 +18,6 @@
    "./__mocks__/**/*",
    "./__tests__/**/*",
    "./lib/**/*",
-    "node_modules",
-    "jest.config*.ts"
+    "node_modules"
  ]
 }
--- a/yarn.lock
+++ b/yarn.lock