NVDA 215.38 ▼1.17%GOOGL 324.89 ▲1.34%MSFT 531.01 ▼0.06%AMD 578.44 ▲3.24%INTC 95.53 ▲1.91%TSMC 439.51 ▲0.60%AMZN 254.60 ▲0.59%META 612.49 ▼1.24%AAPL 343.83 ▼0.94%PLTR 196.81 ▼0.97%
Markets at last close

Security

LiteLLM rotates image-signing key and removes eMudhra root CA

·1 min read

LiteLLM v1.106.3 changes the signing key used for Docker images and Helm charts and removes the eMudhra root CA from trusted certificate bundles. The changes also cover v1.105.4 and v1.103.8. The v1.106.3 release is a patch on top of v1.106.2 and introduces no new database migrations.

Starting with this release, Docker images and Helm charts use the cosign key from commit e82a3c6. The previous key from commit 0112e53 no longer verifies these artifacts. Users must update any configuration that pins the old cosign.pub, including verification scripts, CI checks and admission policies.

The certificate change removes the eMudhra root CA from every trust bundle used by the SDK, proxy and Docker images on stable/1.106.x. The signing-key rotation and certificate removal are the core changes in this patch, alongside the version bump.

Originally reported by docs.litellm.aiRead the source →
Related coverage