Supply Chain Security¶

All container images and Helm charts are built with supply chain security controls in the CI/CD pipeline.

Image Signing¶

All production container images (openvox-operator, openvox-server, openvox-db) are signed with cosign keyless signing using GitHub Actions OIDC.

Verify Image Signatures¶

cosign verify ghcr.io/slauger/openvox-operator:latest \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github\.com/slauger/openvox-operator'

Verify Helm Chart Signatures¶

Helm charts pushed to ghcr.io/slauger/charts/ are also signed:

cosign verify ghcr.io/slauger/charts/openvox-operator:0.9.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github\.com/slauger/openvox-operator'

Attestations¶

Each image includes:

SLSA Provenance (per-platform) - Build provenance in SLSA format, generated by docker/build-push-action with provenance: true
SBOM (per-platform) - Software Bill of Materials in SPDX format, generated with sbom: true
Build Provenance (manifest index) - GitHub-native build provenance attestation via actions/attest-build-provenance, attached to the multi-arch manifest index

Per-platform attestations and the manifest-level attestation are attached as OCI referrers and can be inspected with cosign:

# List attestations
cosign tree ghcr.io/slauger/openvox-operator:latest

# Verify SBOM
cosign verify-attestation ghcr.io/slauger/openvox-operator:latest \
  --type spdxjson \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github\.com/slauger/openvox-operator'

Conforma Policy Validation¶

The release pipeline validates all production images with Conforma (ec CLI) against a set of supply chain policies.

Policy Configuration¶

The policy is defined in .conforma/policy.yaml and includes:

@github collection - GitHub Actions OIDC certificate validation, base image registries, signatures, and attestations

Running Locally¶

Install the ec CLI (see the Conforma releases for the latest version) and validate an image:

# Install ec CLI (check releases page for latest version)
EC_VERSION="$(curl -s https://api.github.com/repos/conforma/cli/releases/latest | grep tag_name | cut -d'"' -f4)"
curl -sSL "https://github.com/conforma/cli/releases/download/${EC_VERSION}/ec_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m)" \
  -o /usr/local/bin/ec && chmod +x /usr/local/bin/ec

# Validate
ec validate image \
  --image ghcr.io/slauger/openvox-operator:latest \
  --policy .conforma/policy.yaml \
  --certificate-identity-regexp "https://github.com/slauger/openvox-operator/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --strict=false \
  --show-successes \
  --output yaml

Base Images¶

All production images use Red Hat UBI9 base images:

Image	Base
`openvox-operator`	`registry.access.redhat.com/ubi9/ubi-minimal`
`openvox-server`	`registry.access.redhat.com/ubi9/ubi`
`openvox-db`	`registry.access.redhat.com/ubi9/ubi`

Base image versions are tracked and auto-updated by Renovate.

Container Security¶

All production containers run with:

Non-root user (USER 1001:0)
Read-only root filesystem (CRD default: true, configurable via config.readOnlyRootFilesystem)
No privilege escalation (allowPrivilegeEscalation: false)
All capabilities dropped (drop: ["ALL"])
OpenShift random-UID compatible (group=root(0))