Ship releases to enterprise customers, signed and on time
Release drops assembled from your versioned builds, scanned, signed and pushed straight to your customer’s registry, even in restricted or air-gapped networks. Every drop comes with an install guide and an audit trail.
Sound familiar?
The red lines are where most teams start. The green lines are where you end up.
- Each customer release is assembled by hand, and one wrong version slips in.
- One manifest lists the versions, and the pipeline collects exactly those.
- Customers ask for signed images, SBOMs and scan reports with every drop.
- Every image and file is scanned, signed and shipped with an SBOM.
- Closed networks mean files travel by laptop, then a VM, then their registry.
- Drops are packaged for each hop, with checksums and verification steps.
- Install instructions are rewritten for each drop and are often stale.
- An install guide is generated from the manifest for every drop.
- “What exactly did you send us in March?” takes a day to answer.
- Every drop is recorded: what, when and to whom.
What you get
Release drops built from a manifest
One file lists the component versions for a drop. The pipeline collects exactly those artifacts. Patch drops work the same way.
Scanned and signed
Every image and file in the drop is scanned and signed with Cosign keyless signing, with SBOMs included.
Pushed with ORAS to OCI registries
Drops are pushed to the customer’s OCI registry (Zot, Harbor, Artifactory and others) using ORAS. For restricted networks, the drop is packaged so it can move from a Windows machine to a VM to the destination registry, step by step.
Auto-generated install guide
Each drop gets a README with versions, checksums, verification commands and install steps (a method of procedure), generated from the manifest so it’s never stale.
Audit trail and notifications
A record of every drop (what, when, to whom) written to your wiki, such as Confluence, plus Teams or email notifications to the right people.
How it runs, in about 3 weeks
- Week 1
Audit and design
How releases are built today, what customers need, which registries and networks they use.
- Week 2
Build the pipeline
Manifest, collection, scanning, signing, ORAS push, generated README.
- Week 3
Restricted networks and handover
Offline transfer path, audit trail, notifications, a dry-run drop with you, runbook, walkthrough and 30 days of support.
Price
A starting price, then a fixed written quote after the call.
Signed release delivery pipeline
Signed, scanned drops to customer registries.
About 3 weeks · quote based on components and customer environments
International clients: USD price quoted after the call
- Manifest-driven drops, including patches
- Scan, sign and SBOM for every artifact
- ORAS push to OCI and air-gapped registries
- Generated install README
- Audit trail and notifications
Not included
- Registry and wiki licences.
- Customer-side infrastructure.
- Travel to customer sites.
Release delivery questions
Our customers are air-gapped. Can this still work?
Which registries do you support?
Do our customers need Cosign to verify?
Can you add this to the CI we already have?
Spending a day on every customer release?
Book a free call and walk me through your last drop.