Skip to content
ReverseDock

Verify a download

Every release is built and signed by the release workflow in GitHub Actions, without long-lived signing keys. You can check that what you downloaded is what that workflow built, from this repository, for a release tag.

Artifact What proves it
rdock-<version>-<target>.tar.gz Listed in SHA256SUMS, and a GitHub build-provenance attestation
SHA256SUMS Keyless cosign signature in SHA256SUMS.sigstore.json
ghcr.io/docker-hunterpedia/rdock:<version> Keyless cosign signature and a build-provenance attestation, both stored in the registry
rdock-<version>.spdx.json SPDX SBOM of the Rust dependencies, for your own scanning

What you need

Section titled “What you need”
  • cosign for signatures.
  • The GitHub CLI (gh) for attestations.
  • sha256sum (Linux) or shasum (macOS).

Release archives

Section titled “Release archives”

Download the archive for your platform, SHA256SUMS and SHA256SUMS.sigstore.json from the release page into one directory:

Terminal window
VERSION=0.2.0-alpha.1
TARGET=x86_64-unknown-linux-musl
BASE="https://github.com/Docker-Hunterpedia/ReverseDock/releases/download/v$VERSION"
curl -fsSLO "$BASE/rdock-$VERSION-$TARGET.tar.gz"
curl -fsSLO "$BASE/SHA256SUMS"
curl -fsSLO "$BASE/SHA256SUMS.sigstore.json"

1. The checksums were signed by the release workflow of this repository, for a tag:

Terminal window
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/Docker-Hunterpedia/ReverseDock/\.github/workflows/release\.yml@refs/tags/v'
Verified OK

The identity ties the signature to .github/workflows/release.yml running for a v* tag. A repository ruleset lets only administrators create release tags.

2. Your archive matches the signed checksums:

Terminal window
sha256sum --ignore-missing -c SHA256SUMS      # macOS: shasum -a 256 --ignore-missing -c SHA256SUMS
rdock-0.2.0-alpha.1-x86_64-unknown-linux-musl.tar.gz: OK

3. The archive was built by GitHub Actions from this repository:

Terminal window
gh attestation verify "rdock-$VERSION-$TARGET.tar.gz" --repo Docker-Hunterpedia/ReverseDock

The command exits with status 0 when the attestation matches, and prints the workflow and commit that built the file.

If any step fails, do not run the binary. Download it again from the release page, and report a persistent failure as described in Security.

Container images

Section titled “Container images”

The image is signed by digest with cosign, using the same workflow identity:

Terminal window
cosign verify ghcr.io/docker-hunterpedia/rdock:0.2.0-alpha.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/Docker-Hunterpedia/ReverseDock/\.github/workflows/release\.yml@refs/tags/v'

cosign lists the checks it performed and prints the signature payload with the image digest. Check the build-provenance attestation too:

Terminal window
gh attestation verify oci://ghcr.io/docker-hunterpedia/rdock:0.2.0-alpha.1 --repo Docker-Hunterpedia/ReverseDock

Tags are never overwritten once published, but a tag is still a name. To be certain you deploy what you verified, use the digest that cosign verify printed:

compose.yaml (excerpt)
services:
  rdock:
    image: ghcr.io/docker-hunterpedia/rdock:0.2.0-alpha.1@sha256:<digest>
Section titled “Related”