Skip to content

Repository navigation

docs(node): verify Docker images with build provenance attestations #1130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jenpaff merged 1 commit into from
Nov 12, 2026
Merged

docs(node): verify Docker images with build provenance attestations #1130

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 26 additions & 4 deletions src/pages/docs/guide/node/installation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,20 +144,42 @@ G4OIGIHqFwKSCA==

</details>

### Docker Image Signatures (Cosign)
### Docker Image Provenance

Docker images are signed with [Cosign](https://docs.sigstore.dev/cosign/signing/overview/) using keyless signing via GitHub Actions OIDC.
Docker images published from `main`, release tags and release-candidate branches carry a [GitHub build provenance attestation](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds), stored next to the image in the registry. Each attestation records the repository, workflow and Git ref that built the image.

To verify a Docker image:

```bash
# Install the GitHub CLI: https://cli.github.com/
gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> \
--repo tempoxyz/tempo
Comment on lines +153 to +156

@claude claude Bot Nov 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) Readers who only install gh and paste the new verify command will see it fail with a login prompt rather than a verification result. The snippet's comment only says to install the GitHub CLI. Without --bundle-from-oci, gh attestation verify fetches attestations from the GitHub API and needs gh auth login first. Fix: tell readers to run gh auth login, as line 106 already does for tempoup. Or, if the attestations really are pushed to the registry, add --bundle-from-oci to both examples (lines 155 and 164).

Why this was flagged

A node operator follows the Docker Image Provenance section at installation.mdx:153-156. They install the GitHub CLI as the comment says and run gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> --repo tempoxyz/tempo. Without --bundle-from-oci, gh gets the attestation from the GitHub attestations API, which needs an authenticated gh. The command stops and asks the user to run gh auth login without verifying anything. On the base branch, the cosign verify example needed no account. The same section, at line 106, does say to "Install and authenticate gh" for tempoup, but the new snippet and the pinned-digest example at line 164 leave that step out. The text says the attestation is "stored next to the image in the registry", but the commands never read it from the registry.

Verification: nit. The snippet at installation.mdx:153-157 is only # Install the GitHub CLI: https://cli.github.com/ followed by gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> --repo tempoxyz/tempo. Neither example passes --bundle or --bundle-from-oci, and nothing near them mentions authentication. Line 106 tells readers to "Install and authenticate gh". The base's cosign verify example needed no GitHub account.

```

This verifies that the image was built by the official Tempo CI pipeline. Images on Docker Hub (`docker.io/tempoxyz/tempo`) verify the same way.

Images are multi-platform (`linux/amd64` and `linux/arm64`). Both the multi-platform image and each platform image are attested, so you can also verify a pinned digest:

```bash
gh attestation verify oci://ghcr.io/tempoxyz/tempo@sha256:<digest> \
--repo tempoxyz/tempo
```

<details>
<summary>Older images signed with Cosign</summary>

Images published before build provenance attestations were signed with [Cosign](https://docs.sigstore.dev/cosign/signing/overview/) using keyless signing via GitHub Actions OIDC. Those signatures still verify:

```bash
# Install cosign: https://docs.sigstore.dev/cosign/system_config/installation/
cosign verify ghcr.io/tempoxyz/tempo:latest \
cosign verify ghcr.io/tempoxyz/tempo:<tag> \
--certificate-identity-regexp="https://github.com/tempoxyz/tempo/" \
--certificate-oidc-issuer="https://token.actions.githubusercontent.com"
```

This verifies that the image was built and signed by the official Tempo CI pipeline.
New images may not carry a Cosign signature. Switch to `gh attestation verify`.

</details>

### SHA256 Checksums

Expand Down
2 changes: 1 addition & 1 deletion src/pages/docs/guide/node/security.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ Tempo's networking protections complement the firewall and isolation rules in th

## Release verification

Always verify release artifacts before running them. Tempo signs all binaries and Docker images — see [Verifying Releases](/docs/guide/node/installation#verifying-releases) for GPG, Cosign, and SHA256 verification instructions.
Always verify release artifacts before running them. Tempo signs all binaries and Docker images — see [Verifying Releases](/docs/guide/node/installation#verifying-releases) for GPG, build provenance, and SHA256 verification instructions.

## Time synchronization

Expand Down
Loading