Skip to main content

Verifying Signed Artifacts

These artifacts are cryptographically signed using Sigstore Cosign:

  • Container images
  • Helm charts

This ensures that the images you pull are authentic, tamper-proof, and built by the official Foreseerr release pipeline.

Additionally each container image also includes a CycloneDX SBOM (Software Bill of Materials) attestation, generated with Trivy, providing transparency about all dependencies included in the image.

Prerequisites​

You will need the following tools installed:

To verify images:

Verifying Signed Images​

Image Locations​

Official Foreseerr images are available from:

  • GitHub Container Registry (GHCR): ghcr.io/selmant/foreseerr:<tag>
  • Docker Hub: selmantr/foreseerr:<tag>

You can view all available tags on the Foreseerr Releases page.

Verifying a Specific Release Tag​

Each tagged release (for example v0.7.0) is immutable and cryptographically signed. Verification should always be performed using the image digest (SHA256).

Retrieve the Image Digest​

docker buildx imagetools inspect ghcr.io/selmant/foreseerr:v0.7.0 --format '{{json .Manifest.Digest}}' | tr -d '"'

Example output:

sha256:abcd1234...

Verify the Image Signature​

cosign verify ghcr.io/selmant/foreseerr@sha256:abcd1234... \
  --certificate-identity "https://github.com/selmant/foreseerr/.github/workflows/release.yml@refs/tags/v0.7.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
Successful Verification Example

Verification for ghcr.io/selmant/foreseerr@sha256:abcd1234...

The following checks were performed:

  • Cosign claims validated
  • Signatures verified against the transparency log
  • Certificate issued by Fulcio to the expected workflow identity

Verifying the latest Tag​

Latest Tag Warning

The latest tag is mutable, meaning it will change with each new release. Always verify the digest that latest currently points to.

Retrieve the Digest for latest​

docker buildx imagetools inspect ghcr.io/selmant/foreseerr:latest --format '{{json .Manifest.Digest}}' | tr -d '"'

Example output:

sha256:abcd1234...

Verify the Signature​

cosign verify ghcr.io/selmant/foreseerr@sha256:abcd1234... \
  --certificate-identity-regexp "https://github.com/selmant/foreseerr/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
tip

The wildcard v.* ensures verification works for any versioned release that latest represents.

Verifying SBOM Attestations​

Each image includes a CycloneDX SBOM attestation.

Verify the Attestation​

cosign verify-attestation ghcr.io/selmant/foreseerr@sha256:abcd1234... \
  --type cyclonedx \
  --certificate-identity "https://github.com/selmant/foreseerr/.github/workflows/release.yml@refs/tags/v0.7.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
Successful Verification Example

Verification for ghcr.io/selmant/foreseerr@sha256:abcd1234...

The following checks were performed:

  • Cosign claims validated
  • Signatures verified against the transparency log
  • Certificate issued by Fulcio to the expected workflow identity

Extract the SBOM for Inspection​

cosign verify-attestation ghcr.io/selmant/foreseerr@sha256:abcd1234... \
  --type cyclonedx \
  --certificate-identity "https://github.com/selmant/foreseerr/.github/workflows/release.yml@refs/tags/v0.7.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq -r '.payload | @base64d' > sbom.json

You can open sbom.json in a CycloneDX viewer or analyse it with Trivy or Dependency-Track.

Expected Certificate Identity​

The expected certificate identity for all signed Foreseerr images is:

https://github.com/selmant/foreseerr/.github/workflows/release.yml@refs/tags/v*

This confirms that the image was:

  • Built by the official Foreseerr Release workflow
  • Produced from the selmant/foreseerr repository
  • Signed using GitHub’s OIDC identity via Sigstore Fulcio

Example: Full Verification Flow​

DIGEST=$(docker buildx imagetools inspect ghcr.io/selmant/foreseerr:latest --format '{{json .Manifest.Digest}}' | tr -d '"')

cosign verify ghcr.io/selmant/foreseerr@"$DIGEST" \
  --certificate-identity-regexp "https://github.com/selmant/foreseerr/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

cosign verify-attestation ghcr.io/selmant/foreseerr@"$DIGEST" \
  --type cyclonedx \
  --certificate-identity-regexp "https://github.com/selmant/foreseerr/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

Verifying Signed Helm charts​

Helm Chart Locations​

Official Foreseerr helm charts are available from:

  • GitHub Container Registry (GHCR): ghcr.io/selmant/foreseerr/foreseerr-chart:<tag>

You can view all available tags on the Foreseerr package page.

Verifying a Specific Release Tag​

Each published chart version (for example 0.9.0) is cryptographically signed. Verification should always be performed using the chart digest (SHA256).

Retrieve the Helm Chart Digest​

docker buildx imagetools inspect ghcr.io/selmant/foreseerr/foreseerr-chart:0.9.0 --format '{{json .Manifest.Digest}}' | tr -d '"'

Example output:

sha256:abcd1234...

Verify the Helm Chart Signature​

cosign verify ghcr.io/selmant/foreseerr/foreseerr-chart@sha256:abcd1234... \
  --certificate-identity "https://github.com/selmant/foreseerr/.github/workflows/helm.yml@refs/heads/develop" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
Successful Verification Example

Verification for ghcr.io/selmant/foreseerr/foreseerr-chart@sha256:abcd1234...

The following checks were performed:

  • Cosign claims validated
  • Signatures verified against the transparency log
  • Certificate issued by Fulcio to the expected workflow identity

Expected Certificate Identity​

The expected certificate identity for all signed Foreseerr charts is:

https://github.com/selmant/foreseerr/.github/workflows/helm.yml@refs/heads/develop

This confirms that the chart was:

  • Published by the official Foreseerr Helm workflow
  • Produced from the selmant/foreseerr repository
  • Signed using GitHub’s OIDC identity via Sigstore Fulcio

Example: Full Verification Flow​

DIGEST=$(docker buildx imagetools inspect ghcr.io/selmant/foreseerr/foreseerr-chart:0.9.0 --format '{{json .Manifest.Digest}}' | tr -d '"')

cosign verify ghcr.io/selmant/foreseerr/foreseerr-chart@"$DIGEST" \
  --certificate-identity-regexp "https://github.com/selmant/foreseerr/.github/workflows/helm.yml@refs/heads/develop" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

Troubleshooting​

IssueLikely CauseSuggested Fix
no matching signaturesIncorrect digest or tagRetrieve the digest again using Docker or Skopeo
certificate identity does not match expectedWorkflow reference changedEnsure your --certificate-identity matches this documentation
cosign: command not foundCosign not installedInstall Cosign from the official release
certificate expiredOld releaseVerify a newer tag or digest

Further Reading​