didericis/bot-bottle
1
0
Fork 0
Code Issues 33 Pull Requests 9 Actions Packages Releases Wiki Activity

Sign and attest bottle images (SLSA/sigstore) #339

New Issue
Open
opened 2026-07-10 00:26:55 -04:00 by didericis · 0 comments
didericis commented 2026-07-10 00:26:55 -04:00
Owner
Copy Link
Copy Source

Why

bot-bottle is self-hosted and open source, which is a structural advantage over closed, cloud-only competitors (Devin, Copilot workspace) — a user can verify what's actually running in their sandbox, those tools' users cannot. We're not capitalizing on that yet: nothing currently lets a user cryptographically confirm that the agent/sidecar images they're running were built from the published source rather than tampered with.

Proposal

  • Adopt sigstore/cosign (keyless signing via OIDC) to sign built agent and sidecar images (Dockerfile.claude, Dockerfile.codex, Dockerfile.sidecars) as part of the release/build pipeline
  • Publish SLSA provenance attestations for each image build (build platform, source commit, build steps)
  • Add a ./cli.py verify (or similar) command that checks a locally built or pulled image's signature/provenance before use, so this is a real, checkable guarantee and not just documentation
  • Document the verification flow prominently — this is a claim that only matters if it's easy for a security-conscious user to actually exercise

Non-goals

  • Not proposing a hosted/paid image registry — this applies to locally built images too
## Why bot-bottle is self-hosted and open source, which is a structural advantage over closed, cloud-only competitors (Devin, Copilot workspace) — a user *can* verify what's actually running in their sandbox, those tools' users cannot. We're not capitalizing on that yet: nothing currently lets a user cryptographically confirm that the agent/sidecar images they're running were built from the published source rather than tampered with. ## Proposal - Adopt sigstore/cosign (keyless signing via OIDC) to sign built agent and sidecar images (`Dockerfile.claude`, `Dockerfile.codex`, `Dockerfile.sidecars`) as part of the release/build pipeline - Publish SLSA provenance attestations for each image build (build platform, source commit, build steps) - Add a `./cli.py verify` (or similar) command that checks a locally built or pulled image's signature/provenance before use, so this is a real, checkable guarantee and not just documentation - Document the verification flow prominently — this is a claim that only matters if it's easy for a security-conscious user to actually exercise ## Non-goals - Not proposing a hosted/paid image registry — this applies to locally built images too
didericis added the Kind/Security label 2026-07-10 00:26:55 -04:00
didericis-codex added the
Priority
Low
4
 label 2026-07-18 03:43:01 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status/Needs Triage
Awaiting initial classification
No Label Kind/Security
Priority
Low
4
Milestone
No items
No Milestone
Assignees
Clear assignees
didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: didericis/bot-bottle#339
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?