Supply-chain verification

Every TruStacks artifact you pull is signed with Sigstore keyless signing. There are no key files to download: you verify against the identity of the GitHub Actions workflow that built and signed it. This page lists each artifact, its signing identity, and the command to verify it.

Why it matters

The runner runs in your cluster, reads your source, and opens pull requests on your platform repo. Before you install it, you should be able to answer:

Is this the artifact TruStacks built? The signature, checked against the publishing workflow’s identity, answers that.
What is in it? Each image carries an SBOM.

What is signed, and by whom

Two repositories publish, with two identities.

Artifact	Reference	Signed by
Runner image	`ghcr.io/trustacks/runner:<version>`	`trustacks-mvp` · `publish-images.yml`
Control-plane image	`ghcr.io/trustacks/control-plane:<version>`	`trustacks-mvp` · `publish-images.yml`
UI image	`ghcr.io/trustacks/ui:<version>`	`trustacks-mvp` · `publish-images.yml`
Runner Helm chart	`ghcr.io/trustacks/charts/runner:<version>`	`trustacks-mvp` · `publish-images.yml`
Constitution policy bundle	`ghcr.io/trustacks/policy/constitution:<version>`	`trustacks-policy` · `publish.yml`

On hosted TruStacks you install the runner chart and image. The control-plane and UI images run the hosted service.

The images and chart share a product version (for example 0.2.13). The policy bundle has its own version line (1.0.0, followed by runners as :1). See Versioning.

Every signing workflow refuses to run from anything but a semver tag, so the identity always ends in @refs/tags/v<version>.

Verify the runner image and chart

Install cosign .


cosign verify \
  --certificate-identity-regexp '^https://github\.com/TruStacks/trustacks-mvp/\.github/workflows/publish-images\.yml@refs/tags/v.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/trustacks/runner:<version>

Swap the last argument for ghcr.io/trustacks/charts/runner:<version> to verify the chart, which is signed by the same workflow. Use the version the Runners page shows you.

Verify the policy bundle


cosign verify \
  --certificate-identity-regexp '^https://github\.com/TruStacks/trustacks-policy/\.github/workflows/publish\.yml@refs/tags/v.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/trustacks/policy/constitution:1

Your runner does the same check at start, inside your cluster, before it loads the bundle. See Policy in force.

Policy bundles signed before 1.0.0

Policy bundles before 1.0.0 (the 0.x and 0.2.14-rcN versions) were signed by a different workflow, https://github.com/TruStacks/trustacks-mvp/.github/workflows/publish-policy.yml. Runners on 0.2.14-rc24 and rc25 accepted both identities for one release cycle. That identity is retired: from 0.2.14-rc26 the runner accepts only trustacks-policy · publish.yml, and nothing is signed with the old one any more. Use it only to verify an old bundle you already hold.

If your own admission policy or audit scripts pin the old identity, move them to the new one.

Identity strings are case-sensitive. The org segment is TruStacks (capital T and S). The registry path ghcr.io/trustacks/... is lowercase. A verify that reports none of the expected identities matched with a subject that starts https://github.com/TruStacks/ usually has the wrong case in your regex.

SBOMs and provenance

Each image is built with an SPDX SBOM and a SLSA provenance attestation attached to its manifest. Read the SBOM with:


docker buildx imagetools inspect ghcr.io/trustacks/runner:<version> \
  --format '{{ json .SBOM }}'

and the provenance with --format '{{ json .Provenance }}'. Feed either to the scanner your security team already uses.

Transparency log

Each signature is recorded in the public Rekor transparency log. Search by identity or digest at search.sigstore.dev .

Admission control

Kyverno, Sigstore policy-controller, and Ratify all take the same two inputs:

Identity regex: one of the two above, by artifact.
OIDC issuer: https://token.actions.githubusercontent.com

There is no public key to distribute and no rotation to schedule.

If verification fails

Do not run the artifact. Check, in order:

The identity. Right repository and workflow for this artifact? Right case?
The reference. Did you verify the tag you are about to deploy?
Tampering. If both are right and it still fails, report it to security@trustacks.com.

Where to go next

Runner Helm chart · install and upgrade the verified chart
Policy in force · how the runner verifies policy at start
Versioning · product versions and policy versions
License · what the Beta license permits