Security

Trust you can verify

QuenchWorks is built so you never have to take our word for it. Everything below is reproducible and checkable from your own terminal.

Zero fixable CVEs, enforced

Every image goes through a Trivy gate that fails the build on any fixable vulnerability. We rebuild on a schedule, because a clean scan only describes the day it ran. The result is a moving target kept clean, not a one-time audit.

Built from source on Wolfi

We compile each application from source with melange, then apko assembles a small nonroot image. There are no Dockerfiles and nothing inherited from another distro, so the attack surface is only what the app needs.

Signed, keyless

Each image and each chart is signed with cosign using GitHub OIDC (Sigstore). There is no long-lived key to leak. The signature ties the artifact back to the workflow that built it, and anyone can check it.

Pinned by digest

Charts reference images by sha256 digest, never a moving tag. What you install is exactly the artifact that passed the gate and was signed, with no room for a tag to drift underneath you.

Verify it yourself

Swap in any image or chart name. These commands are real and need no key, just cosign and the GitHub CLI.

# confirm an image was built and signed by our CI (images have no :latest)
cosign verify ghcr.io/quenchworks/images/redis:8.8.0 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# the same works for any chart, by its version tag
# use the plain ref — cosign rejects an oci:// prefix here
cosign verify ghcr.io/quenchworks/charts/redis:0.0.5 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# verify the SPDX SBOM attestation and the SLSA build provenance in one step
# this is the right tool — not `cosign download sbom`
gh attestation verify oci://ghcr.io/quenchworks/images/redis:8.8.0 --owner quenchworks

# resolve the exact sha256 digest behind the tag
docker buildx imagetools inspect ghcr.io/quenchworks/images/redis:8.8.0 \
  --format '{{.Manifest.Digest}}'
# charts pin this exact digest, never a tag — so what runs cannot drift

The 0-CVE gate

A Trivy scan runs on every build and hard-fails it on any fixable vulnerability, from CRITICAL down to LOW, with --ignore-unfixed so we only block on what we can actually patch. The same gate runs again on a rebuild schedule, so a clean scan is a moving target kept clean as new advisories land, not a one-time audit.

Reporting a vulnerability

Found something? Please follow the disclosure process in our security policy.

Security policy