Verify what you install

Do this once per version. It costs one command and it is the difference between “I pulled a container off the internet” and “I checked who built it”.

Install cosign from the Sigstore project’s own documentation site.

What the signature proves

Both the image and the chart are signed with cosign keyless: the signature is made by our release workflow using its OIDC identity, and recorded in the public Rekor transparency log. There is no key for us to distribute and none for you to manage.

Verification proves provenance — that these exact bytes were produced by our release workflow, from a release tag.

The three commands

# 1. The IMAGE.
cosign verify \
  --certificate-identity-regexp '^https://github.com/seylo-inc/k8s-deploy/\.github/workflows/release-agent\.yml@refs/tags/agent-v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/seylo-inc/seylo-agent:0.1.0

# 2. The CHART. A Helm OCI artifact is signed the same way;
#    `helm pull` on its own verifies nothing.
cosign verify \
  --certificate-identity-regexp '^https://github.com/seylo-inc/k8s-deploy/\.github/workflows/release-agent\.yml@refs/tags/agent-v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/seylo-inc/charts/seylo-agent:0.1.0

# 3. The SBOM, which is ATTESTED to the image rather than merely attached,
#    so you can confirm it came from the same build.
cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp '^https://github.com/seylo-inc/k8s-deploy/\.github/workflows/release-agent\.yml@refs/tags/agent-v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/seylo-inc/seylo-agent:0.1.0

Expect Verified OK. If verification fails, do not install. The bytes are not what we published.

Both --certificate-* flags are mandatory

Without them, cosign accepts a signature made by anyone with a Sigstore identity. That is worse than not checking at all, because it produces a passing check that means nothing.

To be stricter still, replace --certificate-identity-regexp with the exact identity including the version tag, rather than the agent-v prefix pattern.

Pin the digest

A tag says which release you meant. A digest says which bytes you got, and it cannot be moved.

Reading it requires no trust — it is a lookup:

crane digest ghcr.io/seylo-inc/seylo-agent:0.1.0
# or
docker buildx imagetools inspect ghcr.io/seylo-inc/seylo-agent:0.1.0

Then pass it to Helm alongside the tag:

helm upgrade --install ... --set image.digest=sha256:<64 hex>

The chart renders repository:tag@sha256:…. Kubernetes resolves the digest and ignores the tag, so the image cannot be swapped underneath you — while kubectl get pod -o wide still shows a readable version. A malformed digest is rejected by the chart at render time rather than thirty seconds later as an ImagePullBackOff.

The chart published to the registry already defaults to the digest of the image it was released with, so a Helm install from the OCI registry is digest-pinned even if you pass nothing.

The chart in our source repository is not, and cannot be: the digest of a version cannot be known before the release that publishes it, and an invented one would produce an install command that fails on an unresolvable manifest.

If the portal shows an amber 'not digest-pinned' chip

The server has no digest recorded for that version yet. The install page tells you how to pin it by hand, and your Seylo operator can make it permanent.

Read the chart before you run it

helm show values oci://ghcr.io/seylo-inc/charts/seylo-agent --version 0.1.0

helm template seylo-agent \
  oci://ghcr.io/seylo-inc/charts/seylo-agent --version 0.1.0 \
  --set serverUrl=wss://x/agent/connect --set clusterId=x --set enrollmentToken=x

helm template renders every object the install would create — including the exact RBAC — without touching your cluster. If you are the person approving the install, this is the output to read.

Why the image is public

Your cluster holds no credential for our registry. An authenticated pull would make the agent uninstallable in exactly the environments it exists for. So the image and chart are public on purpose: no registry login, no pull secret, no account.

Building the agent yourself is supported, but it is not something you need to do.

Never track :latest

It is published for registry-UI reasons only. With imagePullPolicy: IfNotPresent, two nodes in the same cluster can end up running different builds, and re-pointing the tag does not fix a node that already pulled.