Skip to main content
TruStacks

Product · Security

Verify yourself.

Every TruStacks image and policy bundle is signed via Sigstore keyless OIDC against our release workflow’s own identity, with an SBOM attached to each manifest and an entry in the Rekor public transparency log. Nothing about our supply chain depends on you trusting our marketing copy. Run the commands below. The output is the proof.

A vendor asking to run software inside your cluster, gating your production changes, owes you a way to check them that does not route through their sales team.

Run this on your machine

You need cosign and nothing else. No account, no key from us, no conversation with our sales team.

Verify the runner image

$ cosign verify \
  --certificate-identity-regexp \
    'https://github.com/TruStacks/trustacks-mvp/.github/workflows/publish-images.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/trustacks/runner:latest

Verify the constitution policy bundle

$ cosign verify \
  --certificate-identity-regexp \
    'https://github.com/TruStacks/trustacks-mvp/.github/workflows/publish-policy.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/trustacks/policy/constitution:latest

Read the build provenance

$ docker buildx imagetools inspect \
  ghcr.io/trustacks/runner:latest --format '{{ json .Provenance }}'

Returns an in-toto SLSA build-provenance attestation for each platform: the source revision the image was built from, the build type, and the parameters it was built with. It is attached to the manifest and covered by the same signature you verified above.

Read the SBOM

$ docker buildx imagetools inspect \
  ghcr.io/trustacks/runner:latest --format '{{ json .SBOM }}'

A successful verification prints that the code-signing certificate was verified against trusted certificate authority certificates. It confirms the artifact was built by the TruStacks release workflow and has not been altered since. If it ever fails, that is a finding we want: tell us.

What we sign and why.

Federal SBOM mandates and Executive Order 14028 made signed-artifact substrate non-negotiable for the regulated segment. We built it that way from day one.

  • Signed Rego policy bundles

    Constitution and customer overlay are both cosign-signed. An init-container verifies the bundle before the workload extracts it. If the signature fails, the workload does not start.

  • Sigstore keyless signing on every release

    Every published image and the policy bundle are signed via Sigstore keyless OIDC against the release workflow's own identity. There is no long-lived signing key to steal, because there is no signing key. Every release is also recorded in the Rekor public transparency log.

  • SBOM attached to every image

    A Software Bill of Materials is attached to each image manifest at build time and enumerates every vendored dependency. Query it with docker buildx imagetools inspect, without asking us for anything.

  • No production credentials in agent hands

    The agent crew opens pull requests against a separate platform repo. ArgoCD or Flux deploys merged PRs. Credentials never leave your environment, and there is no autonomous merge path.

Security disclosures

Report a vulnerability.

Security reports go through the contact form. We follow RFC 9116 (security.txt); the canonical disclosure record is published at /.well-known/security.txt. We acknowledge reports within one business day.

Want a deeper supply-chain walkthrough?

We’ll show you the signing pipeline, the SBOM contents, and how the init-container verifies the bundle before workloads start.

Request a demoHow policy works