almet/dangerzone
1
0
Fork 0
mirror of https://github.com/freedomofpress/dangerzone.git synced 2025-04-28 18:02:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 11
dangerzone/docs/developer/independent-container-updates.md
Alexis Métaireau 66ac7e56f8
Add a script to verify Github attestations
2025-02-11 16:13:25 +01:00

989 B
Raw Blame History

Independent Container Updates

Since version 0.9.0, Dangerzone is able to ship container images independently from issuing a new release of the software.

This is useful as images need to be kept updated with the latest security fixes.

Nightly images and attestations

Each night, new images are built and pushed to our container registry, alongside with a provenance attestation, enabling anybody to ensure that the image has been originally built by Github CI runners, from a defined source repository (in our case freedomofpress/dangerzone).

To verify the attestations against our expectations, use the following command:

poetry run ./dev_scripts/registry.py attest ghcr.io/freedomofpress/dangerzone/dangerzone:latest --repo freedomofpress/dangerzone

In case of sucess, it will report back:

🎉 The image available at `ghcr.io/freedomofpress/dangerzone/dangerzone:latest` has been built by Github runners from the `freedomofpress/dangerzone` repository.