jfxs/test-ci repository overview

⁠jfxs / test-ci

A test project to develop CI/CD pipeline for tests projects:

A cntlm⁠ Docker image:

• lightweight image based on Alpine Linux,
• multiarch with support of amd64 and arm64,
• non-root container user,
• automatically updated,
• image signed with Cosign⁠,
• an SBOM attestation added using Syft⁠.

The main repository.

The Docker Hub registry.

⁠Built with

Docker latest tag is 3.19.1-012, 3.19, 3⁠ and contains:

Details are updated on Dockerhub Overview page⁠ when an image is published.

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available here⁠ To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | .payload | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See the LICENSE⁠ file for details.