IntersectMBO · jpraynaud · Jul 20, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
@@ -1,13 +1,13 @@
 blank_issues_enabled: true
 contact_links:
   - name: Contributing guidelines
-    url: https://github.com/input-output-hk/mithril/blob/master/CONTRIBUTING.md
+    url: https://github.com/IntersectMBO/mithril/blob/main/CONTRIBUTING.md
     about: Some rules & processes we honor.
 
   - name: Feature ideas
-    url: https://github.com/input-output-hk/mithril/discussions/categories/ideas
+    url: https://github.com/IntersectMBO/mithril/discussions/categories/ideas
     about: Maybe someone else had the same or a similar idea already?
 
   - name: All issues
-    url: https://github.com/input-output-hk/mithril/issues
+    url: https://github.com/IntersectMBO/mithril/issues
     about: Check whether your issue is not already covered here.
@@ -164,17 +164,17 @@ runs:
 
         - Download the **Mithril signer** in the current directory:
         \`\`\`bash
-        curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/input-output-hk/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-signer -d ${{ inputs.tag }} -p \$(pwd)
+        curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/IntersectMBO/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-signer -d ${{ inputs.tag }} -p \$(pwd)
         \`\`\`
 
         - Download the **Mithril client CLI** in the current directory:
         \`\`\`bash
-        curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/input-output-hk/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-client -d ${{ inputs.tag }} -p \$(pwd)
+        curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/IntersectMBO/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-client -d ${{ inputs.tag }} -p \$(pwd)
         \`\`\`
 
         - Download the **Mithril aggregator** in the current directory:
         \`\`\`bash
-        curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/input-output-hk/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-aggregator -d ${{ inputs.tag }} -p \$(pwd)
+        curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/IntersectMBO/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-aggregator -d ${{ inputs.tag }} -p \$(pwd)
         \`\`\`
         EOF
 
@@ -208,9 +208,9 @@ runs:
 
         | Binary             |              Image name              |                             URL                              |
         | ------------------ | :----------------------------------: | :----------------------------------------------------------: |
-        | mithril-aggregator | mithril-aggregator:$MITHRIL_IMAGE_ID | ghcr.io/input-output-hk/mithril-aggregator:$MITHRIL_IMAGE_ID |
-        | mithril-signer     |   mithril-signer:$MITHRIL_IMAGE_ID   |   ghcr.io/input-output-hk/mithril-signer:$MITHRIL_IMAGE_ID   |
-        | mithril-client     |   mithril-client:$MITHRIL_IMAGE_ID   |   ghcr.io/input-output-hk/mithril-client:$MITHRIL_IMAGE_ID   |
+        | mithril-aggregator | mithril-aggregator:$MITHRIL_IMAGE_ID | ghcr.io/intersectmbo/mithril-aggregator:$MITHRIL_IMAGE_ID |
+        | mithril-signer     |   mithril-signer:$MITHRIL_IMAGE_ID   |   ghcr.io/intersectmbo/mithril-signer:$MITHRIL_IMAGE_ID   |
+        | mithril-client     |   mithril-client:$MITHRIL_IMAGE_ID   |   ghcr.io/intersectmbo/mithril-client:$MITHRIL_IMAGE_ID   |
         EOF
 
     - name: List packaged assets

@@ -33,7 +33,7 @@ runs:
           PACKAGE="$(echo "$PACKAGE" | xargs)" # trim
 
           echo "Check crate latest published version for '$PACKAGE' package"
-          LATEST_REMOTE_VERSION=$(curl -sL https://crates.io/api/v1/crates/$PACKAGE  --user-agent "iog/mithril (https://github.com/input-output-hk/mithril)" | jq -r '.crate.newest_version')
+          LATEST_REMOTE_VERSION=$(curl -sL https://crates.io/api/v1/crates/$PACKAGE  --user-agent "iog/mithril (https://github.com/IntersectMBO/mithril)" | jq -r '.crate.newest_version')
           LOCAL_VERSION=$(cargo metadata --quiet --no-deps | jq -r --arg package "$PACKAGE" '.packages[] | select(.name== $package) | .version')
           echo "Latest crate.io version: $LATEST_REMOTE_VERSION"
           echo "Local version: $LOCAL_VERSION"

@@ -0,0 +1,172 @@
+name: Backfill GHCR
+
+on:
+  workflow_dispatch:
+    inputs:
+      distributions:
+        description: Comma separated distributions and moving tags to copy
+        required: true
+        type: string
+        default: 2617.0,2603.1,2543.1-hotfix,2537.0,2524.0,unstable,latest,pre-release
+      source_organization:
+        description: Organization owning the legacy packages
+        required: true
+        type: string
+        default: input-output-hk
+      dry_run:
+        description: Resolve and check the images without copying them
+        required: true
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  backfill:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        package:
+          [mithril-aggregator, mithril-client, mithril-signer, mithril-relay]
+
+    env:
+      REGISTRY: ghcr.io
+      MOVING_TAGS: unstable latest pre-release
+
+    steps:
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up crane
+        uses: imjasonh/setup-crane@v0.7
+
+      - name: Copy the images to the new namespace
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DISTRIBUTIONS: ${{ inputs.distributions }}
+          DRY_RUN: ${{ inputs.dry_run }}
+          PACKAGE: ${{ matrix.package }}
+          REPOSITORY_OWNER: ${{ github.repository_owner }}
+          SOURCE_ORGANIZATION: ${{ inputs.source_organization }}
+        run: |
+          set -uo pipefail
+
+          # GHCR rejects upper case repository names, and the owner is not lower case
+          target_organization=$(echo "$REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')
+          source_organization=$(echo "$SOURCE_ORGANIZATION" | tr '[:upper:]' '[:lower:]')
+
+          if [ "$source_organization" = "$target_organization" ]; then
+            echo "::error::The source and the target organization are both '$target_organization': the transfer has not happened yet, or the wrong source was given"
+            exit 1
+          fi
+
+          source_image="$REGISTRY/$source_organization/$PACKAGE"
+          target_image="$REGISTRY/$target_organization/$PACKAGE"
+
+          # A distribution is published as '<distribution>-<short commit>', whereas a moving tag is
+          # published as is. The distributions are also git tags, so they cannot be told apart from
+          # the moving tags by resolving them against the repository.
+          resolve_source_tag() {
+            local distribution=$1
+            local moving_tag reference commit
+
+            for moving_tag in $MOVING_TAGS; do
+              if [ "$distribution" = "$moving_tag" ]; then
+                echo "$distribution"
+                return 0
+              fi
+            done
+
+            reference=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$distribution" 2>/dev/null) || return 1
+            commit=$(echo "$reference" | jq -r '.object.sha')
+            if [ "$(echo "$reference" | jq -r '.object.type')" = "tag" ]; then
+              commit=$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$commit" --jq '.object.sha') || return 1
+            fi
+
+            # 'jq' yields 'null' and '--jq' yields an empty string on an unexpected payload, both of
+            # which would silently resolve to a tag that no package publishes
+            echo "$commit" | grep -qE '^[0-9a-f]{40}$' || return 1
+
+            echo "$distribution-$(echo "$commit" | cut -c1-7)"
+          }
+
+          error_file=$(mktemp)
+          copied=0
+          skipped=0
+          failed=0
+
+          IFS=',' read -ra distributions <<< "$DISTRIBUTIONS"
+          for distribution in "${distributions[@]}"; do
+            distribution=$(echo "$distribution" | tr -d '[:space:]')
+            if [ -z "$distribution" ]; then
+              continue
+            fi
+
+            if ! source_tag=$(resolve_source_tag "$distribution"); then
+              echo "::error::Could not resolve the distribution '$distribution' in $GITHUB_REPOSITORY"
+              failed=$((failed + 1))
+              continue
+            fi
+
+            if ! source_digest=$(crane digest "$source_image:$source_tag" 2>"$error_file"); then
+              error=$(cat "$error_file")
+              # Only an unknown manifest means the tag is genuinely not published: anything else
+              # (authentication, throttling, registry outage) must not be reported as a benign skip
+              case "$error" in
+                *MANIFEST_UNKNOWN* | *NAME_UNKNOWN*)
+                  echo "Skipped $source_image:$source_tag, the package does not publish this tag"
+                  skipped=$((skipped + 1))
+                  ;;
+                *)
+                  echo "::error::Could not read $source_image:$source_tag: $error"
+                  failed=$((failed + 1))
+                  ;;
+              esac
+              continue
+            fi
+
+            # Anything but an explicit 'false' is treated as a dry run so that a copy is never made by accident
+            if [ "$DRY_RUN" != "false" ]; then
+              echo "Would copy $source_image:$source_tag ($source_digest) to $target_image:$source_tag"
+              copied=$((copied + 1))
+              continue
+            fi
+
+            # A tag already in the target namespace was published after the move and is newer than
+            # the legacy one: overwriting it would roll the consumers of that tag back
+            if ! crane copy --no-clobber "$source_image:$source_tag" "$target_image:$source_tag"; then
+              echo "::error::Could not copy $source_image:$source_tag to $target_image:$source_tag"
+              failed=$((failed + 1))
+              continue
+            fi
+
+            if ! target_digest=$(crane digest "$target_image:$source_tag" 2>"$error_file"); then
+              echo "::error::Could not read back $target_image:$source_tag: $(cat "$error_file")"
+              failed=$((failed + 1))
+              continue
+            fi
+
+            if [ "$source_digest" != "$target_digest" ]; then
+              echo "::error::$target_image:$source_tag already holds $target_digest and was left untouched instead of being overwritten with $source_digest"
+              failed=$((failed + 1))
+              continue
+            fi
+
+            echo "Copied $source_image:$source_tag to $target_image:$source_tag ($target_digest)"
+            copied=$((copied + 1))
+          done
+
+          if [ "$DRY_RUN" != "false" ]; then
+            echo "$PACKAGE (dry run): $copied resolved, $skipped skipped, $failed failed" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "$PACKAGE: $copied copied, $skipped skipped, $failed failed" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          [ "$failed" -eq 0 ]
@@ -9,7 +9,7 @@ TAG_FILE=$ASSETS_DIRECTORY/tags.json
 TAGS_TO_COMPARE=()
 
 mkdir -p $ASSETS_DIRECTORY
-LATEST_TAGS=$(gh api /repos/input-output-hk/mithril/releases | jq -r '[.[] | select(.prerelease == false)][].tag_name' | head -n "$TOTAL_RELEASES")
+LATEST_TAGS=$(gh api /repos/IntersectMBO/mithril/releases | jq -r '[.[] | select(.prerelease == false)][].tag_name' | head -n "$TOTAL_RELEASES")
 
 for TAG in $LATEST_TAGS; do
   if [[ "$TAG" == "$TAG_TO_TEST" ]]; then
@@ -29,7 +29,7 @@ do
     echo ">>>> Retrieving artifacts for release ${TAG_NAME}"
     ARCHIVE_DIRECTORY="./mithril-binaries/$TAG_NAME"
     mkdir -p $ARCHIVE_DIRECTORY
-    gh release download --repo input-output-hk/mithril $TAG_NAME -O mithril-archive --pattern "mithril-$TAG_NAME*-linux-x64.tar.gz"
+    gh release download --repo IntersectMBO/mithril $TAG_NAME -O mithril-archive --pattern "mithril-$TAG_NAME*-linux-x64.tar.gz"
     tar xzf mithril-archive -C $ARCHIVE_DIRECTORY mithril-aggregator mithril-signer mithril-client mithril-relay
     rm mithril-archive
 done
@@ -30,7 +30,7 @@ on:
         description: The genesis verification key location for the Mithril network.
         required: false
         type: string
-        default: https://raw.githubusercontent.com/input-output-hk/mithril/main/mithril-infra/configuration/pre-release-preview/genesis.vkey
+        default: https://raw.githubusercontent.com/IntersectMBO/mithril/main/mithril-infra/configuration/pre-release-preview/genesis.vkey
       transactions_hashes_to_certify:
         description: Comma separated list of transactions hashes to test certification on.
         required: false
@@ -43,7 +43,7 @@ on:
         description: The ancillary verification key location to verify the ancillary files.
         required: false
         type: string
-        default: https://raw.githubusercontent.com/input-output-hk/mithril/main/mithril-infra/configuration/pre-release-preview/ancillary.vkey
+        default: https://raw.githubusercontent.com/IntersectMBO/mithril/main/mithril-infra/configuration/pre-release-preview/ancillary.vkey
       enable_debug:
         description: Enable debug output ("-vvv") for the mithril-client calls
         required: true
@@ -64,7 +64,7 @@ on:
         default: https://aggregator.testing-preview.api.mithril.network/aggregator
       genesis_verification_key:
         type: string
-        default: https://raw.githubusercontent.com/input-output-hk/mithril/main/mithril-infra/configuration/testing-preview/genesis.vkey
+        default: https://raw.githubusercontent.com/IntersectMBO/mithril/main/mithril-infra/configuration/testing-preview/genesis.vkey
       transactions_hashes_to_certify:
         type: string
         default: 1f7dbc899a898ceb4274bbc33b31ca5f0de497753c6c6795fa34838fc252de9b,c43e809de628f7c1ba41a44f188ed3872bb1f97aa101271e35424a8e1d95bea9,c61e22ac4a79a02b28ed36217369ff6959465790a4fe9e66738b7a820e174fcd
@@ -73,7 +73,7 @@ on:
         default: ccaac23d5444c5ca5c0948e0062d50738d961e3f953b1b230ef5206055aceed6,d5720d553b2f547605e7f5f64ebdabb1325b65b37a28525b06ff5b722c320ba7,e5234b6e99fe2763629e396cd37852040e0587e32d2a37c2d473ab046ca38ca9
       ancillary_verification_key:
         type: string
-        default: https://raw.githubusercontent.com/input-output-hk/mithril/main/mithril-infra/configuration/testing-preview/ancillary.vkey
+        default: https://raw.githubusercontent.com/IntersectMBO/mithril/main/mithril-infra/configuration/testing-preview/ancillary.vkey
       enable_debug:
         type: boolean
         default: false
@@ -112,8 +112,8 @@ jobs:
             echo "debug_level=-vvv" >> $GITHUB_OUTPUT
           fi
 
-          echo "GENESIS_VERIFICATION_KEY=$(curl -s ${{ inputs.genesis_verification_key }})" >> $GITHUB_OUTPUT
-          echo "ANCILLARY_VERIFICATION_KEY=$(curl -s ${{ inputs.ancillary_verification_key }})" >> $GITHUB_OUTPUT 
+          echo "GENESIS_VERIFICATION_KEY=$(curl -sSfL ${{ inputs.genesis_verification_key }})" >> $GITHUB_OUTPUT
+          echo "ANCILLARY_VERIFICATION_KEY=$(curl -sSfL ${{ inputs.ancillary_verification_key }})" >> $GITHUB_OUTPUT
 
           wget -q -O - ${{ inputs.aggregator_endpoint }} > aggregator_capabilities.json
           CARDANO_DATABASE_V2_CAPABILITY=$(jq '.capabilities.signed_entity_types | contains(["CardanoDatabase"])' aggregator_capabilities.json)
@@ -417,7 +417,7 @@ jobs:
         run: |
           mkdir -p $PWD/data
           chmod -R a+w $PWD/data
-          echo "mithril_client=docker run --rm -e NETWORK=$NETWORK -e GENESIS_VERIFICATION_KEY=$GENESIS_VERIFICATION_KEY -e ANCILLARY_VERIFICATION_KEY=$ANCILLARY_VERIFICATION_KEY -e AGGREGATOR_ENDPOINT=$AGGREGATOR_ENDPOINT -e GITHUB_TOKEN=$GITHUB_TOKEN --name='mithril-client' -v $PWD/data:/app/data ghcr.io/input-output-hk/mithril-client:$MITHRIL_IMAGE_ID"  >> $GITHUB_OUTPUT
+          echo "mithril_client=docker run --rm -e NETWORK=$NETWORK -e GENESIS_VERIFICATION_KEY=$GENESIS_VERIFICATION_KEY -e ANCILLARY_VERIFICATION_KEY=$ANCILLARY_VERIFICATION_KEY -e AGGREGATOR_ENDPOINT=$AGGREGATOR_ENDPOINT -e GITHUB_TOKEN=$GITHUB_TOKEN --name='mithril-client' -v $PWD/data:/app/data ghcr.io/intersectmbo/mithril-client:$MITHRIL_IMAGE_ID"  >> $GITHUB_OUTPUT
 
       - name: Show client version
         shell: bash
@@ -552,7 +552,7 @@ jobs:
         run: |
           mkdir -p $PWD/data
           chmod -R a+w $PWD/data
-          echo "mithril_client=docker run --rm -e NETWORK=$NETWORK -e GENESIS_VERIFICATION_KEY=$GENESIS_VERIFICATION_KEY -e ANCILLARY_VERIFICATION_KEY=$ANCILLARY_VERIFICATION_KEY -e AGGREGATOR_ENDPOINT=$AGGREGATOR_ENDPOINT -e GITHUB_TOKEN=$GITHUB_TOKEN --name='mithril-client' -v $PWD/data:/app/data ghcr.io/input-output-hk/mithril-client:$MITHRIL_IMAGE_ID"  >> $GITHUB_OUTPUT
+          echo "mithril_client=docker run --rm -e NETWORK=$NETWORK -e GENESIS_VERIFICATION_KEY=$GENESIS_VERIFICATION_KEY -e ANCILLARY_VERIFICATION_KEY=$ANCILLARY_VERIFICATION_KEY -e AGGREGATOR_ENDPOINT=$AGGREGATOR_ENDPOINT -e GITHUB_TOKEN=$GITHUB_TOKEN --name='mithril-client' -v $PWD/data:/app/data ghcr.io/intersectmbo/mithril-client:$MITHRIL_IMAGE_ID"  >> $GITHUB_OUTPUT
 
       - name: fetch latest snapshot hash
         id: last_snapshot

@@ -30,6 +30,11 @@ As a minor extension, we have adopted a slightly different versioning convention
 
 - Added a new internal crate `mithril-merkle-tree` for the implementation of Merkle tree and merkelized map primitives used by Mithril nodes.
 
+- Moved the repository to the `IntersectMBO` GitHub organization:
+  - The genesis, era and ancillary verification key URLs of the `networks.json` file now target `IntersectMBO`.
+  - The Docker images of the nodes are now published to the `ghcr.io/intersectmbo` namespace.
+  - The legacy `input-output-hk` URLs and released images keep working. Refresh any pinned verification key URL or image reference at your next upgrade.
+
 - **UNSTABLE**:
   - Support for SNARK-friendly rigid protocol message openable in recursive circuit.
   - Support for SNARK-friendly genesis certificate primitives.

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at {{ email }}. All
+reported by contacting the project team at conduct@intersectmbo.org. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.