timothyswan/defectdojo-valkey repository overview

A bit-for-bit mirror of registry.access.redhat.com/hi/valkey:9.0.4⁠. We don't rebuild this image — Red Hat does, against their Hummingbird (RHHI) base, and we host their bits in this registry so the DefectDojo Quadlet stack can pull a known image even when registry.access.redhat.com isn't reachable (BLK, disconnected production).

Valkey⁠ is the Linux Foundation fork of Redis. RHHI doesn't ship a hi/redis image; valkey stands in. Wire-compatible with the Redis protocol (identifies as redis_version 7.2.4 to clients), serving DefectDojo as the Celery broker + Django cache. Requires --requirepass + --bind 0.0.0.0 exec args because its default protected-mode yes posture otherwise drops the broker's first command. See defectdojo/quadlet/defectdojo-valkey.container.example.

⁠Two cosign signatures

This image carries two cosign signatures stacked on the same manifest digest:

1. Red Hat's keyless signature (preserved by skopeo copy --all from the upstream :.sig sidecar tag). Sigstore Fulcio-issued cert bound to Red Hat's OIDC identity. Verify keyless:

   cosign verify \
     --certificate-identity-regexp '<red-hat identity>' \
     --certificate-oidc-issuer-regexp '<red-hat issuer>' \
     <this-image-ref>
   

   Copy
2. Our internal cosign signature, added by the mirror CI job using cii-tooling/keys/internal-ci.pub's private half. Same key that signs every other image we host. Verify with:

   cosign verify --key cii-tooling/keys/internal-ci.pub <this-image-ref>
   

   Copy

Both signatures are valid — pick whichever trust chain matters for the verifier. The internal signature gives consumers a uniform cosign verify --key invocation across every image we publish; Red Hat's keyless signature lets anyone trace the chain back to the original upstream build.

⁠Usage

Pulled by defectdojo-valkey.container in the DefectDojo Quadlet stack. Exposed via NetworkAlias=redis so DefectDojo's stock DD_CELERY_BROKER_URL=redis://... configuration points at this container.

⁠Supply chain

• Upstream: registry.access.redhat.com/hi/valkey:9.0.4
• Mirror tag: <this-registry>/defectdojo-valkey:9.0.4-rhhi
• Mirrored via: skopeo copy --all (preserves Red Hat's :.sig + :.att sidecars).
• Added by us: cosign key-only signature, CycloneDX SBOM attestation, SLSA v0.2 provenance attestation. All three use the same internal cosign key.
• SBOM scope: layer contents of the multi-arch index pulled at mirror time.
• Provenance: records the mirror operation — subject is this mirror's digest, material[0] points at the upstream manifest digest.