jfxs/bompage repository overview

⁠Docker Bompage

A fully automated Docker image bundling bompage⁠ and its prerequisites (git, ssh-keygen, trivy) on Alpine, with continuous builds, regression testing, and CI‑ready tooling — no more installing bompage and its dependencies on every CI run.

• amd64 and arm64,
• automatically kept up to date by Renovate⁠ (base image, bompage version, and the pinned git/openssh-keygen/ca-certificates apk packages, and trivy),
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

This image includes bompage, git (to clone/commit/push the central bompage repository), ssh-keygen (to sign and verify attestations) and trivy (vulnerability scanner used by bompage scan) — everything the push, prune, check and pages bompage CI jobs need, pre-installed, plus Trivy for scan once the bundled bompage release provides that command.

⁠Running bompage

Example to build the static dashboard from a reports/ tree in the current directory:

docker run -it --rm -v $(pwd):/work jfxs/bompage bompage build --reports reports --output public

push and prune need write access to the central repository; pass the token through the environment rather than the command line:

docker run -it --rm -v $(pwd):/work -e BOMPAGE_TOKEN jfxs/bompage \
  bompage push --component my-service --sbom sbom.spdx.json --repo https://gitlab.com/acme/bompage.git

To check the bompage version bundled in the image:

docker run -t --rm jfxs/bompage bompage --version

⁠Replacing an inline bompage CI job

Instead of a job that installs bompage and its dependencies on every run:

push-report:
  image: python:3.14-alpine
  script:
    - apk add --no-cache git openssh-keygen
    - pip install --no-cache-dir bompage==<version>
    - bompage push --component my-service --sbom sbom.spdx.json --repo https://gitlab.com/acme/bompage.git

use the pre-built image directly (replace <tag> with a published tag, see Versioning⁠):

push-report:
  image: jfxs/bompage:<tag>
  script:
    - bompage push --component my-service --sbom sbom.spdx.json --repo https://gitlab.com/acme/bompage.git

The check gate (fails the pipeline on a forged or emptied history) runs the same way, with no extra install:

check:
  image: jfxs/bompage:<tag>
  script:
    - bompage check --allowed-signers trust/allowed_signers --min-checked 1

bompage scan (vulnerability scan, available only in bompage releases that ship it) needs network access to download Trivy's vulnerability database into its cache (~/.cache/trivy, or TRIVY_CACHE_DIR when running as a non-root user). The image is larger than a plain python:alpine one because it embeds the Trivy binary.

⁠Built with

Docker latest tag is 2.0.1-001, 2.0, 2⁠ and has:

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the bompage version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<bompage_version>-<increment>

Example: 1.5.1-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.