Supply-chain verification
Verify the signed container images, SBOMs, build provenance and air-gap package published with each Scrydon release.
Scrydon publishes signed container images with each release, an SBOM and build provenance for each image, and a signed air-gap package. This page covers how to verify them.
What's signed
| Artefact | Signing tool | Where it's published |
|---|---|---|
| OCI images | Cosign (keyless) | OCI registry (configurable per release channel) |
| SBOM | Cosign attestation (CycloneDX) | Attached to each image |
| Provenance | GitHub build attestation (SLSA) | Attached to each image |
| Zarf air-gap package | Cosign sign-blob (keyless) + SHA256SUMS | Package on the OCI registry; signature file and checksums on the release |
Verifying an image
Every signature is keyless: Cosign signs with a short-lived certificate bound to the release workflow's GitHub identity, so there is no public key to distribute. You verify the identity instead.
cosign verify \
--certificate-identity-regexp 'https://github.com/scrydon/.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
<registry>/scrydon/<image>:<version>cosign verify returns the verified signature payload or an error if the signature doesn't match.
The Helm chart
The chart is published as an OCI artifact at oci://<registry>/scrydon/charts/scrydon and is not Cosign-signed today. Every image it deploys is, so verify the images it renders, and pin the chart by the digest helm pull prints:
helm pull oci://<registry>/scrydon/charts/scrydon --version <version>
# Pulled: <registry>/scrydon/charts/scrydon:<version>
# Digest: sha256:…Fetching the SBOM
The SBOM is attached to each image as a CycloneDX attestation. Retrieve it with:
cosign download attestation \
--predicate-type 'https://cyclonedx.org/bom' \
<registry>/scrydon/<image>:<version> | jq -r '.payload | @base64d' | jq .The SBOM lists every package in the image with its version and license.
Verifying provenance
Build provenance is a GitHub artifact attestation in SLSA format, pushed next to each image. Verify it with the GitHub CLI:
gh attestation verify oci://<registry>/scrydon/<image>:<version> --owner scrydonThe provenance includes:
- The source commit.
- The build entry point.
- The build environment.
- The build trigger.
It is the build evidence EU CRA Annex I.1.2(h) asks for, at SLSA Build Level 2 (GitHub-hosted runners, signed provenance).
Verifying the air-gap package
The Zarf package is signed as a file. Keyless verification needs the public Sigstore transparency log, so run it on a connected machine before the package crosses the gap:
PKG=zarf-package-scrydon-amd64-<version>.tar.zst
cosign verify-blob "${PKG}" \
--bundle "${PKG}.bundle" \
--certificate-identity-regexp '^https://github.com/scrydon/main/\.github/workflows/release-platform\.yml@' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com'Carry SHA256SUMS across with the package and check it inside, which proves the file you deploy is the one you verified:
sha256sum -c SHA256SUMS --ignore-missingWhen SHA256SUMS.asc is published, gpg --verify SHA256SUMS.asc SHA256SUMS adds a signature check that needs no network at all. The full flow is in Air-gapped deployment.
What to do if verification fails
A failed verification means do not deploy. Either the artefact has been tampered with, or it wasn't published by Scrydon's release pipeline. Contact Scrydon support before proceeding.
Related
- Air-gapped deployment — verifying and deploying the Zarf package end to end.
- Compliance → EU CRA — what regulators expect to see.
- Compliance → ISO 27001 — A.8.25 supply-chain integrity.