ff0x/choom-relay repository overview

⁠Container image mirror

This repository mirrors released container images. Source and contributions are managed through Radicle⁠. Use the project's approved release metadata for the source repository and exact image digest. A mirror is not the canonical source or proof of authenticity.

⁠Verify a release

Obtain the release's public signing key through an independently trusted source. Set TRUSTED_PUBLIC_KEY, MIRROR_IMAGE and REVIEWED_DIGEST from trusted release metadata. The digest includes its algorithm prefix. Verify the exact mirrored content:

cosign verify --key "$TRUSTED_PUBLIC_KEY" "${MIRROR_IMAGE}@${REVIEWED_DIGEST}"

Keep normal Rekor verification enabled. Missing signatures or required log evidence must fail closed. Do not substitute a moving tag or an unverified key from the same download location.