Signed, scanned releases your customers can trust
Cosign image signing, SBOMs, vulnerability reports and secret scanning, added to the CI you already have. Every release ships with the evidence enterprise security teams and auditors ask for.
Sound familiar?
The red lines are where most teams start. The green lines are where you end up.
- “Are your images signed? Can you provide an SBOM?” The honest answer is no.
- Every image is signed in CI and every release ships with an SBOM.
- Nobody can prove which commit and build produced the image in production.
- Provenance links each artifact to its exact commit, workflow run and inputs.
- Vulnerability scans happen on a laptop, if at all, and the results are lost.
- A scan report is saved next to the release it belongs to.
- A token committed two years ago still sits in git history.
- Secrets are scanned on every pull request, and history has been checked once, end to end.
- New rules (EO 14028, NIST SSDF, the EU Cyber Resilience Act) feel like someone else’s problem.
- You have a short evidence pack that answers what buyers and auditors ask.
What you get
Keyless image and artifact signing
Cosign with GitHub OIDC and Sigstore. No private keys to store, rotate or leak. Container images and release files are signed in the pipeline, and anyone can verify them.
SBOMs on every build
CycloneDX or SPDX software bills of materials generated in CI and attached to each release, so you can answer “are we affected?” in minutes when the next big CVE lands.
Vulnerability scan reports per release
Image and dependency scans (JFrog Xray if you use Artifactory, or an open-source scanner if you don’t), with the report saved next to the release it belongs to.
Secret scanning
TruffleHog on every pull request, plus a one-time full-history scan so you know what’s already in git and what to rotate.
Code quality gates
Linting with Super-Linter, licence and copyright-header checks, and static analysis for C/C++ where your licences allow it (for example Klocwork).
Provenance and a short evidence pack
Build records that link each artifact to its commit, workflow run and inputs, plus a one-page document that maps what’s in place to the questions customers and auditors usually ask. I don’t certify compliance; I give you the evidence.
How it runs, in about 10 working days
The timeline depends on how many pipelines are in scope. You get a fixed plan after the call.
- Day 1
Audit call
Your pipeline, registries and what customers are asking for.
- Days 2–4
Signing
Keyless Cosign signing of images and release files, with verification documented.
- Days 5–6
SBOMs and scans
SBOMs and vulnerability reports attached to every release.
- Days 7–8
Secrets and code checks
TruffleHog on pull requests, a full-history scan, linting and header checks.
- Days 9–10
Handover
Evidence pack, runbook, recorded walkthrough and 30 days of support.
Price
A starting price, then a fixed written quote after the call.
Supply-chain security setup
Signing, SBOMs and scans added to your existing CI.
About 10 working days
International clients: USD price quoted after the call
- Cosign keyless signing
- SBOMs (CycloneDX or SPDX)
- Vulnerability reports per release
- Secret scanning on every pull request
- Evidence pack, runbook, 30 days of support
Not included
- Fixing the vulnerabilities the scans find. I’ll list and prioritise them, and fixes can be quoted separately.
- Scanner or registry licences such as JFrog Xray, paid by you in your own accounts.
Supply-chain security questions
Do you make us compliant with the Cyber Resilience Act or SSDF?
Do we need JFrog Xray?
Is keyless signing safe without a private key?
We’re not on GitHub Actions. Does this still work?
Will you sign an NDA?
Not sure where your gaps are?
Send me your repo or CI file and I’ll do a free 15-minute review, with a short list of what’s missing.