This document explains how to verify Uptime Robot Operator images, report vulnerabilities, and apply deployment security best practices.

• Container image security
• Verify image signatures
• Software Bill of Materials (SBOM)
• Report vulnerabilities
• Deployment best practices

All images published by the Uptime Robot Operator are scanned for vulnerabilities, signed with Cosign, and include Software Bill of Materials (SBOM) attestations.

Every image is scanned using Trivy for known vulnerabilities before release. The build fails if any critical or high-severity vulnerabilities are detected.

• Scan results are uploaded to the GitHub Security tab
• Vulnerabilities are tracked and remediated promptly
• Images are rebuilt regularly to incorporate security patches

All images are signed using Cosign with keyless signing via GitHub Actions OpenID Connect (OIDC). This ensures image authenticity and integrity.

The Uptime Robot Operator uses distroless base images (gcr.io/distroless/static:nonroot):

• Contains only the application and its runtime dependencies
• No shell, package manager, or unnecessary tools
• Runs as a non-root user
• Minimises attack surface

Prerequisites: Cosign installed.

To verify a signed release image:

cosign verify \
  --certificate-identity="https://github.com/joelp172/uptime-robot-operator/.github/workflows/release.yml@refs/heads/main" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/joelp172/uptime-robot-operator:v1.0.0

Release signatures are produced by .github/workflows/release.yml, which runs on main.
The expected Fulcio certificate identity therefore uses @refs/heads/main (not @refs/tags/...).

cosign verify \
  --certificate-identity="https://github.com/joelp172/uptime-robot-operator/.github/workflows/release.yml@refs/heads/main" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/joelp172/uptime-robot-operator:v1.0.0

Successful verification outputs:

Verification for ghcr.io/joelp172/uptime-robot-operator:v1.0.0 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

Each release includes SBOM files in both SPDX and CycloneDX formats. SBOMs provide a complete inventory of all software components in the image.

1. Go to the Releases page
2. Download sbom-spdx.json or sbom-cyclonedx.json from the release assets

SBOMs are attested to the images. Verify them with:

# Verify SPDX SBOM attestation
cosign verify-attestation \
  --type spdxjson \
  --certificate-identity="https://github.com/joelp172/uptime-robot-operator/.github/workflows/release.yml@refs/heads/main" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/joelp172/uptime-robot-operator:v1.0.0 | jq -r .payload | base64 -d | jq .

# Verify CycloneDX SBOM attestation
cosign verify-attestation \
  --type cyclonedx \
  --certificate-identity="https://github.com/joelp172/uptime-robot-operator/.github/workflows/release.yml@refs/heads/main" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/joelp172/uptime-robot-operator:v1.0.0 | jq -r .payload | base64 -d | jq .

Use Trivy to analyse SBOMs for known vulnerabilities:

trivy sbom sbom-spdx.json

If you discover a security vulnerability, report it by:

1. DO NOT open a public issue
2. Use GitHub's private vulnerability reporting feature: https://github.com/joelp172/uptime-robot-operator/security/advisories/new
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We respond within 48 hours and work with you to address the issue promptly.

When you deploy the operator, follow these practices:

Use specific version tags instead of latest or beta:

# Good
image: ghcr.io/joelp172/uptime-robot-operator:v1.0.0

# Avoid
image: ghcr.io/joelp172/uptime-robot-operator:latest

Add image verification to your deployment pipeline:

#!/bin/bash
set -e

IMAGE="ghcr.io/joelp172/uptime-robot-operator:v1.0.0"

# Use release workflow identity for versioned images
cosign verify \
  --certificate-identity="https://github.com/joelp172/uptime-robot-operator/.github/workflows/release.yml@refs/heads/main" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  "${IMAGE}"

# Deploy only if verification succeeds (exit code 0)
kubectl apply -f deployment.yaml