mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
SaelixCode
3da0aa6036
Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.
87 lines
4.0 KiB
Plaintext
87 lines
4.0 KiB
Plaintext
---
|
|
title: Verifying Docker Images
|
|
description: Verify that the Sencho image you pulled was built and signed by the official GitHub Actions pipeline.
|
|
---
|
|
|
|
Every published Sencho Docker image is signed by the official GitHub Actions pipeline using [Sigstore cosign](https://docs.sigstore.dev/) keyless signing. The signature is backed by a short-lived certificate issued by Sigstore's public Fulcio certificate authority, tied to the GitHub Actions workflow run that produced the image. You can verify this signature yourself before pulling the image into production.
|
|
|
|
Every image also ships with an embedded SBOM (Software Bill of Materials) and [SLSA](https://slsa.dev) (Supply-chain Levels for Software Artifacts) provenance attestation, so you can inspect exactly what went into the image and which workflow run built it.
|
|
|
|
<Note>
|
|
Image signing is available starting with Sencho **v0.43.0**. Earlier releases do not ship a cosign signature; running `cosign verify` against them will fail, which is expected and does not indicate tampering. If you are on an older version, the first step is to upgrade.
|
|
</Note>
|
|
|
|
## Why verify
|
|
|
|
Verification guarantees:
|
|
|
|
1. The image was built from the [studio-saelix/sencho](https://github.com/studio-saelix/sencho) repository on GitHub.
|
|
2. The build ran inside a GitHub Actions workflow, not on someone's laptop.
|
|
3. The image has not been tampered with between publish and pull.
|
|
|
|
<Note>
|
|
Verification is optional. If you skip it, Sencho still works exactly the same; you are just trusting Docker Hub to deliver the right bytes. Verification adds a second independent check.
|
|
</Note>
|
|
|
|
## Install cosign
|
|
|
|
[cosign](https://docs.sigstore.dev/system_config/installation/) is a single static binary. Install it once on any machine you use to pull Sencho.
|
|
|
|
<CodeGroup>
|
|
|
|
```bash macOS (Homebrew)
|
|
brew install cosign
|
|
```
|
|
|
|
```bash Linux (binary)
|
|
curl -Lo cosign https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
|
|
chmod +x cosign
|
|
sudo mv cosign /usr/local/bin/
|
|
```
|
|
|
|
```bash Windows (Scoop)
|
|
scoop install cosign
|
|
```
|
|
|
|
</CodeGroup>
|
|
|
|
## Verify a released image
|
|
|
|
Replace `<tag>` with the version you intend to pull, for example `0.42.7`, `0.42`, or `latest`.
|
|
|
|
```bash
|
|
cosign verify saelix/sencho:<tag> \
|
|
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com
|
|
```
|
|
|
|
<Note>
|
|
Images released before the repository migration (prior to v0.65.x) were signed with the identity `https://github.com/AnsoCode/Sencho/...`. To verify those older images, use the combined regexp:
|
|
`"https://github.com/(AnsoCode/Sencho|studio-saelix/sencho)/.*"`
|
|
</Note>
|
|
|
|
A successful verification prints the signature, the Rekor transparency log entry, and the certificate that signed it. If the image is not signed by the official Sencho pipeline, the command exits with a non-zero status and you should not run that image.
|
|
|
|
## Inspect the SBOM and provenance
|
|
|
|
Both the SBOM and SLSA provenance are attached to the published image as [OCI referrers](https://docs.docker.com/build/attestations/attestation-storage/). You can inspect them with `docker buildx imagetools`:
|
|
|
|
```bash
|
|
docker buildx imagetools inspect saelix/sencho:<tag> --format "{{json .SBOM}}"
|
|
docker buildx imagetools inspect saelix/sencho:<tag> --format "{{json .Provenance}}"
|
|
```
|
|
|
|
The SBOM lists every package baked into the image with versions and licenses. The provenance records the exact GitHub Actions workflow run, commit SHA, and builder that produced it.
|
|
|
|
## Available tags
|
|
|
|
Each release publishes two moving tags plus one immutable tag, so you can choose how aggressively you want to track updates:
|
|
|
|
| Tag | Example | Updates on |
|
|
|---|---|---|
|
|
| `latest` | `saelix/sencho:latest` | Every release |
|
|
| `X.Y` | `saelix/sencho:0.42` | Every patch release in the `0.42.x` line |
|
|
| `X.Y.Z` | `saelix/sencho:0.42.7` | Never (immutable) |
|
|
|
|
For production, pin to `X.Y.Z` or `X.Y` and verify the signature on every pull. For staging or development, `latest` is fine.
|