Supply Chain Security

Published Rustume release images on GHCR are signed and attested through the lgtm-ci reusable-docker.yml workflow. Verify Docker image signatures and inspect SLSA provenance and SBOM attestations before deploying to production.

Image signing

Release images are signed with Sigstore cosign keyless signing via GitHub Actions OIDC.

cosign verify ghcr.io/lgtm-hq/rustume:latest \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github\.com/lgtm-hq/lgtm-ci/\.github/workflows/reusable-docker\.yml@refs/.*$'

Replace latest with a semver tag (e.g. 0.16.0) to pin a specific release.

A successful verification confirms the image was built by the trusted CI workflow — not tampered with after publish.

SLSA provenance

SLSA provenance attestations document how the image was built (source commit, builder, dependencies).

cosign verify-attestation \
  --type https://slsa.dev/provenance/v1 \
  ghcr.io/lgtm-hq/rustume:latest \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github\.com/lgtm-hq/lgtm-ci/\.github/workflows/reusable-docker\.yml@refs/.*$'

Inspect the attestation payload:

cosign verify-attestation \
  --type https://slsa.dev/provenance/v1 \
  ghcr.io/lgtm-hq/rustume:latest \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github\.com/lgtm-hq/lgtm-ci/\.github/workflows/reusable-docker\.yml@refs/.*$' \
  | jq .

SBOM attestations

Software Bill of Materials (SBOM) attestations list packages included in the image. Attach during the same publish workflow as provenance.

cosign verify-attestation \
  --type spdx \
  ghcr.io/lgtm-hq/rustume:latest \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github\.com/lgtm-hq/lgtm-ci/\.github/workflows/reusable-docker\.yml@refs/.*$'

Use SBOM data for vulnerability scanning in your registry or with tools like OSV-Scanner (also run in Rustume CI via lgtm-hq/py-lintro).

Dependency auditing

The Rustume repository runs:

• OSV-Scanner — Rust and JavaScript dependency checks
• cargo-deny / cargo-audit — crate policy and RustSec advisory database
• Dependency Review — GitHub Action on pull requests
• lgtm-ci — reusable workflows for Docker signing and CI hardening

Self-hosters should still verify image signatures at deploy time rather than relying solely on latest.

Pinning recommendations

Environment	Tag strategy
Production	Semver pin (0.16.0) + cosign verify
Staging	Semver minor pin (0.16)
Development	main or local --build

Never use build-* CI staging tags in production deployments.