Downstream of: You shall use MSGH provisioning for all your releases or else you don't have the attestation that the whole world depends on in their "security" processes.

"Was it signed by github? Then it is good." lmao

But this causes friction if you do something out of the ordinary, and they definitely did that. Problem upon problem.

If you pulled v26.06.7, latest, v26.06.7-vls or latest-vls before reading this, check the digest and re-pull if it does not match the table above.

Between 28 August 16:04 UTC and 1 September, those tags served images that reported v26.06.7 on startup but did not contain the fixes in this release. They were published automatically by CI from a placeholder tag. They have been replaced, and the incorrect manifests are no longer referenced by any tag.

https://github.com/ElementsProject/lightning/releases/tag/v26.06.7