LiteLLM is moving to Rust 🦀Read the latest updates.›

LiteLLM v1.106.3, v1.105.4 and v1.103.8 change the image-signing key and drop the eMudhra root CA

Deploy this version

Docker

docker run \
-e LITELLM_MASTER_KEY=sk-<paste-a-long-random-key> \
-e DATABASE_URL=postgresql://<user>:<password>@<host>:5432/<dbname> \
-e STORE_MODEL_IN_DB=True \
-p 4000:4000 \
docker.litellm.ai/berriai/litellm:1.103.8

Pip

pip install litellm==1.103.8

This release is published as ghcr.io/berriai/litellm:v1.103.8. See the GitHub release and the full releases page

v1.103.8 is a patch release on top of v1.103.7. It moves image signing to a new cosign key, removes the eMudhra root CA from every certificate bundle and fixes the otel callback on stable/1.103.x. There are no new database migrations. The v1.103.8 tag points at 20d52b0

The image-signing key has changed

Starting with this release, every Docker image and Helm chart is signed with the cosign key from commit e82a3c6. Verifying with the previous key from commit 0112e53 fails. Update anything that pins the old cosign.pub, such as cosign verify scripts, CI checks and admission policies.

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.8

What's Changed

• Every certificate bundle the SDK, proxy and Docker images trust no longer includes the eMudhra root CA - PR #47670, PR #47969
• Docker images and Helm charts are signed with the cosign key from commit e82a3c6. The previous key from commit 0112e53 no longer verifies them - PR #48103
• The otel callback initializes with OpenTelemetry 1.44 and newer instead of failing - PR #42431

These changes and the version bump are backported in PR #48075

Full Changelog

https://github.com/BerriAI/litellm/compare/v1.103.7...v1.103.8