Check that what runs is what we signed

• Container images, by digest. Each image of a release is scanned, then signed by digest with Cosign using the release key pair, and verified before its release tag is pushed.
• A software bill of materials per image. A CycloneDX SBOM is attached to each image as a Cosign attestation signed with the same key.
• The offline install bundle. The bundle used for self-hosted installs (the self-hosted edition is in early access) carries a checksum manifest of every file inside it; a copy of that manifest sits beside the bundle as a sidecar and is signed with the same release key.

The private key and its passphrase stay on the release host. The deploy to CMDash Cloud checks each image's signature against the same public key before loading it, and a failed check stops the deploy; an override exists and is recorded with its reason.

The public key, cosign-release.pub, is published beside each offline bundle and is available from security@cmdash.com. Before trusting a copy, check its fingerprint. It must print:

sha256sum cosign-release.pub

c997d392839242298936ccd47d4223bad6e4d360dd18d32fa380bb0412960f78

Do not use a key whose fingerprint differs.

Always verify by digest, never by tag. A wrong key, a missing signature or an altered image makes the command exit non-zero.

cosign verify --key cosign-release.pub \
  ghcr.io/bgovanlu/cmdash/api@sha256:<digest>

Verifying the attestation also verifies its signature:

cosign verify-attestation --key cosign-release.pub \
  --type cyclonedx ghcr.io/bgovanlu/cmdash/api@sha256:<digest>

Then read the SBOM itself:

cosign download attestation ghcr.io/bgovanlu/cmdash/api@sha256:<digest> | \
  jq -r '.payload' | base64 -d | jq .

Run the verifier published with the bundle, passing the key explicitly. It checks the outer checksum, the release signature over the manifest (with cosign if installed, otherwise openssl, and no network either way), and every file inside against that signed manifest. It refuses an unsigned or tampered bundle.

./verify-bundle.sh cmdash-onprem-<tag>.tar.gz --pubkey cosign-release.pub

A passing check shows that the image or bundle you hold is byte for byte the one the release key signed, and the SBOM tells you what is inside it. It says nothing about whether rebuilding the source yourself would produce the same bytes, and this page makes no claim that it would. Build provenance (SLSA) is an open item on the supply-chain roadmap, described on the security overview.