bundles

This repository is the declarative source of truth for vendoring upstream artifacts into the ASVO mirror.

File structure

bundles/

Bundle declarations (CUE): one bundle per file, schema lives alongside the data (schema.cue).

locks/

Digest-pinned lock files, generated by CI on the resolve stage. Never edited by hand.

One file per bundle, locks/<bundle>.lock.json:

{
  "bundle": "cilium",
  "artifacts": {
    "images": {
      "cilium": {
        "ref": "quay.io/cilium/cilium:v1.19.6",
        "version": "v1.19.6",
        "digest": "sha256:..."
      }
    },
    "charts": {
      "cilium": {
        "ref": "https://helm.cilium.io/cilium-1.19.6.tgz",
        "version": "1.19.6",
        "digest": "sha256:..."
      }
    }
  }
}

Verifying

Every mirrored artifact is signed, and every mirrored image carries an SPDX SBOM attestation. Signatures are made without a transparency log, so verification needs --insecure-ignore-tlog; the public half of the key is cosign.pub in this repository.

cosign verify --key cosign.pub --insecure-ignore-tlog \
  registry.asvo.io/cilium/operator:v1.19.6
cosign verify-attestation --key cosign.pub --insecure-ignore-tlog \
  --type spdxjson registry.asvo.io/cilium/operator:v1.19.6

Local testing

cue vet -c ./bundles
cue export ./bundles --out json