mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-05 08:27:42 +00:00
Anso
5f7a887ed6
Restructures the Documentation tab so each group answers one operator question. - Split the 12-page "Stacks & Deployments" into Stacks (per-stack work) and Deployment (the act of deploying); promote Resources Hub to a standalone item. - Dissolve the 2-page "Platform" junk drawer: Sidebar moves to Stacks, Host Console moves to Fleet. - Rename "Fleet & Multi-Node" to "Fleet"; absorb Node Compatibility from Reference. Move Scheduled Operations from Fleet to Automation (now a 4-page group covering Scheduled Ops, Auto-Update, Auto-Heal, Webhooks). - Clean up the Reference tab: drop misplaced node-compatibility, move root-level security.mdx into reference/, delete the orphan reference/verifying-images.mdx after porting its Available Tags table into operations/verifying-images.mdx. - Reorder top-level groups: Operations moves above Reference. - Rename two misleading page titles: "Deploy Progress Modal" becomes "Deploy Progress" (drops the UI implementation leak); "Auto-Update Readiness" becomes "Auto-Update Policies" (matches filename and sibling "Auto-Heal Policies"). Verified: docs.json parses as valid JSON, 59 disk .mdx files match 59 nav entries with zero orphans and zero broken refs.
126 lines
4.5 KiB
Plaintext
126 lines
4.5 KiB
Plaintext
---
|
|
title: Verifying Published Images
|
|
description: How to verify signatures, provenance, SBOMs, and CVE triage for Sencho Docker images.
|
|
---
|
|
|
|
Every Sencho release image is published to two registries with identical content: Docker Hub (`saelix/sencho`) and GitHub Container Registry (`ghcr.io/studio-saelix/sencho`). Every image is signed and carries verifiable supply-chain artifacts on both registries. The `cosign verify` examples below use the Docker Hub path; substitute `ghcr.io/studio-saelix/sencho:<tag>` to verify the GHCR copy.
|
|
|
|
## Prerequisites
|
|
|
|
Install the following tools once:
|
|
|
|
```bash
|
|
# cosign (Sigstore)
|
|
brew install cosign # macOS
|
|
# or: https://github.com/sigstore/cosign/releases
|
|
|
|
# syft (optional, for inspecting SBOM content)
|
|
brew install syft
|
|
# or: https://github.com/anchore/syft/releases
|
|
|
|
# Trivy (optional, for local vulnerability scan with VEX)
|
|
brew install trivy
|
|
# or: https://github.com/aquasecurity/trivy/releases
|
|
```
|
|
|
|
## Verify the image signature
|
|
|
|
Every published tag is signed with cosign keyless signing via GitHub Actions OIDC. No private key is stored anywhere; the signing identity is bound to the GitHub Actions workflow that published the image.
|
|
|
|
```bash
|
|
cosign verify saelix/sencho:<tag> \
|
|
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com
|
|
```
|
|
|
|
A successful verification prints the verified payload and exits 0. The Rekor transparency log entry is included in the output; you can also query it directly:
|
|
|
|
```bash
|
|
cosign tree saelix/sencho:<tag>
|
|
```
|
|
|
|
## Verify SLSA provenance
|
|
|
|
BuildKit produces an SLSA v1 provenance attestation during every multi-arch build. Retrieve and verify it:
|
|
|
|
```bash
|
|
cosign verify-attestation \
|
|
--type slsaprovenance \
|
|
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
|
```
|
|
|
|
## Retrieve the CycloneDX SBOM
|
|
|
|
```bash
|
|
cosign verify-attestation \
|
|
--type cyclonedx \
|
|
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
|
```
|
|
|
|
Alternatively, download `sbom.cdx.json` directly from the GitHub Release assets for the matching version.
|
|
|
|
## Retrieve the SPDX SBOM
|
|
|
|
```bash
|
|
cosign verify-attestation \
|
|
--type spdxjson \
|
|
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
|
```
|
|
|
|
`sbom.spdx.json` is also available as a GitHub Release asset.
|
|
|
|
## Retrieve the VEX document
|
|
|
|
The OpenVEX document explains Sencho's triage decisions for any CVEs that appear in vendored dependencies but are not reachable via Sencho's usage of those dependencies:
|
|
|
|
```bash
|
|
cosign verify-attestation \
|
|
--type openvex \
|
|
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
|
```
|
|
|
|
`sencho.openvex.json` is also available as a GitHub Release asset and at `security/vex/sencho.openvex.json` in the source repository.
|
|
|
|
## Run a local vulnerability scan with VEX applied
|
|
|
|
To reproduce the same scan that gates every release:
|
|
|
|
```bash
|
|
# Download the VEX document
|
|
curl -Lo sencho.openvex.json \
|
|
https://github.com/studio-saelix/sencho/releases/latest/download/sencho.openvex.json
|
|
|
|
# Scan with VEX applied (exit 1 if any unresolved HIGH/CRITICAL CVE)
|
|
trivy image \
|
|
--vex sencho.openvex.json \
|
|
--severity HIGH,CRITICAL \
|
|
--exit-code 1 \
|
|
saelix/sencho:<tag>
|
|
```
|
|
|
|
A clean result means no unresolved HIGH or CRITICAL CVEs. CVEs listed as `not_affected` in the VEX document are suppressed with their justification visible in the VEX file.
|
|
|
|
<Note>
|
|
Trivy 0.36.0 or later is required for `--vex` flag support.
|
|
</Note>
|
|
|
|
## Available tags
|
|
|
|
Each release publishes two moving tags plus one immutable tag, so you can choose how aggressively you want to track updates:
|
|
|
|
| Tag | Example | Updates on |
|
|
|---|---|---|
|
|
| `latest` | `saelix/sencho:latest` | Every release |
|
|
| `X.Y` | `saelix/sencho:0.42` | Every patch release in the `0.42.x` line |
|
|
| `X.Y.Z` | `saelix/sencho:0.42.7` | Never (immutable) |
|
|
|
|
For production, pin to `X.Y.Z` or `X.Y` and verify the signature on every pull. For staging or development, `latest` is fine.
|