CloudBees CI on modern cloud platforms Docker images are signed and include a software bill of materials (SBOM), so you can verify their authenticity and review their software composition.
Verify the CloudBees CI Docker images
CloudBees CI on modern cloud platforms uses Docker containers to run a cluster of computers within the Kubernetes container management system.
CloudBees CI on modern cloud platforms includes the following Docker containers:
-
cloudbees-cloud-core-oc: Operations center -
cloudbees-core-mm: Managed controller
In a standard installation, the CloudBees Helm chart pulls the CloudBees CI cloudbees-cloud-core-oc and cloudbees-core-mm images from Docker Hub.
The CloudBees CI Docker images are signed, so that you can verify their origin and authenticity. Verifying the origin and authenticity of public Docker images is an optional step in the installation process. It can help ensure that you are not the victim of a "man-in-the-middle" attack or other types of image tampering.
You should verify the signatures before you run the Docker images. If you have an internal Docker registry that pulls images to use internally, you can verify the images at that time.
In order to verify the CloudBees CI Docker images, you must download Cosign verification software. Cosign is a component of the Sigstore solution, a collection of projects designed to make software signatures easier.
For versions 2.440.3.7 and earlier, use Cosign 1.x to verify signed Docker images. For all other versions, use either Cosign 1.x or Cosign 2.x.
To verify the authenticity of CloudBees CI Docker images, type one of the following commands:
-
To verify the operations center image for version 2.568.3.37907, type:
-
To verify the managed controller image for version 2.568.3.37907 type:
Cosign responds with a message that indicates whether the images are validated as authentic. An exit code of 0 indicates that the images are authentic. If the images are not validated as authentic, you should contact CloudBees Support.
Download the CloudBees CI software bill of materials
A Software Bill of Materials (SBOM) lists the software components included in a Docker image.
CloudBees CI on modern cloud platforms Docker images include an SBOM in CycloneDX JSON format, attached as an attestation alongside each image on Docker Hub. The cloudbees-cloud-core-oc and cloudbees-core-mm images support SBOM download in CloudBees CI on modern cloud platforms 2.568.1.37445 and later.
If your organization requires software supply chain transparency for compliance or risk assessment, you can download the SBOM to review the components included in a CloudBees CI on modern cloud platforms Docker image.
Download the SBOM
To download the SBOM for a CloudBees CI on modern cloud platforms Docker image, run the following command:
| 1 | Replace <image> with the image reference for the operations center (cloudbees/cloudbees-cloud-core-oc) or managed controller (cloudbees/cloudbees-core-mm), using the bare image name, a tag, or a digest. |
The output is JSON containing a CycloneDX bill of materials listing the software components included in the image.
To save the output to a file instead of printing it to the terminal, append > sbom.json to the command.
|