Anthias container images come with signed build provenance

This is for people who check where software comes from before they run it, such as a security team. Nothing changes on your screens and you don't need to do anything, but you can now confirm with 1 command that the software on a player was built by the Anthias project itself.

An Anthias player runs 3 containers, server, viewer and redis, pulled from GitHub Container Registry, with a copy of each image on Docker Hub. From Anthias 2026.07.3, every one of those images, for every board, is published with a signed build provenance attestation. It records the repository, workflow and commit that built the image, so you can check that an image came from the Anthias build before you run it.

Check an image with the GitHub CLI:

gh attestation verify \
    oci://ghcr.io/screenly/anthias-server:<short-hash>-<board> \
    --repo Screenly/Anthias

<board> is one of pi2, pi3, pi3-64, pi4-64, pi5, x86 or arm64. A release's short hash is in the docker-tag file attached to its GitHub release: for 2026.07.3 it's a782add. Put anthias-viewer or anthias-redis in place of anthias-server to check the other 2.

The latest-<board> tags point at the same images and pass the same check. So does the Docker Hub copy, oci://docker.io/screenly/anthias-server:<short-hash>-<board>, because the attestation belongs to the image itself rather than to one registry.

Images built for earlier releases have no attestation. The disk images on the release page aren't covered either: check those against the .sha256 file published next to each one.