SBOM and image signatures

What is produced on every release

For each of the two images (ithura-app, ithura-live):

1. SPDX-JSON SBOM generated with syft, describing every package included in the image (Go modules, npm modules bundled into the SPA, OS packages).
2. Cosign signature on the image manifest, using keyless signing through GitHub Actions' OIDC identity.
3. Signed SBOM attestation attached to the image, so the SBOM is verifiable without a separate download.

Where they land:

• Container registry: signature and SBOM attestation live in the same OCI repo as the image, discoverable via cosign.
• GitHub release: the SBOM JSON is also uploaded as a plain-file release asset, so a reviewer with no cosign install can still grab and read it.

Verify the image signature

cosign verify \
  --certificate-identity-regexp 'https://github.com/aluchir/ithura/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/aluchir/ithura-app:v1.42.0

A successful verification prints the signing certificate details and a trust bundle. Failure is a hard exit non-zero.

Verify the SBOM attestation

cosign verify-attestation \
  --type spdxjson \
  --certificate-identity-regexp 'https://github.com/aluchir/ithura/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/aluchir/ithura-app:v1.42.0 \
  | jq -r '.payload' | base64 -d | jq '.predicate' > ithura-app.spdx.json

You now have the SBOM as ithura-app.spdx.json, cryptographically tied to the image you are about to run.

Download the SBOM without cosign

If you just want to read the package list, fetch the release-asset copy directly from the GitHub release page:

https://github.com/aluchir/ithura/releases/download/v1.42.0/sbom-ithura-app.spdx.json

This copy is byte-identical to the signed attestation on the image, so either source is equally authoritative for review purposes. Use cosign verification when the origin has to be provably tied to the CI build.

Generate the SBOM locally

The same tool runs on your laptop:

# From a local build:
docker build -t ithura-app:local -f go-app/Dockerfile.allinone .
syft ithura-app:local -o spdx-json > sbom-local.spdx.json

Useful when you build your own image (a fork, an air-gap install) and need an SBOM to feed into your internal vulnerability-management pipeline.

What is in the SBOM

• Every Go module in the API binary, resolved to the exact version from go.sum.
• Every npm dependency compiled into the SPA bundle, from pnpm-lock.yaml.
• The base-image OS packages (Alpine or Debian minimal, depending on the image stage).
• The Ithura source itself, tagged with the commit hash so a reviewer can pin exactly what code the binary was built from.