timothyswan/step-ca repository overview

⁠step-ca — RHHI rebase

step-ca⁠ is smallstep's certificate authority daemon — runs an internal PKI with ACME, JWK, OIDC, and X5C provisioners, automated renewal, and policy enforcement. This image is rebuilt from source on Red Hat Hardened Images⁠, applying RHHI's hardened base to the upstream binary.

⁠Build

• Base: hi/go:latest-builder (build) → hi/curl (runtime — see "Daemon container shape" below for why hi/curl, not hi/core-runtime)
• Source pin: full upstream commit SHA recorded in build.yml
• Version embedding: -X main.Version=${VERSION} (composed in the Containerfile from the --build-arg VERSION=$VERSION set by the build job; matches upstream Makefile's pattern)
• Binary name: step-ca
• CGO disabled, -trimpath, local toolchain only

⁠Supply-chain attestations

Every image tag carries:

• cosign signature (key-only, no Rekor transparency log)
• CycloneDX SBOM attached as OCI attestation
• SLSA v0.2 provenance attached as OCI attestation

⁠Daemon container shape

ENTRYPOINT + CMD match upstream's smallstep/step-ca image so the Ansible role's Quadlet (ansible/roles/step_ca/templates/step-ca.container.j2) can swap sca_image to the rebased version without changing the Exec= line:

• ENTRYPOINT: /usr/local/bin/step-ca
• CMD: ["--password-file", "/home/step/secrets/password", "/home/step/config/ca.json"]
• USER: 65534:65534 (the Quadlet's Volume=...:U remaps the bind-mounted STEPPATH ownership to match)

⁠Operational notes

• Drop-in replacement for the upstream smallstep image. Runtime base is hi/curl (not the more common hi/core-runtime) specifically so the Ansible role's Quadlet HealthCmd=curl -fsSk https://127.0.0.1:9000/health works inside the rebased image with no operator opt-out — same behavior as upstream smallstep/step-ca. The trade-off is ~30 MB of extra image size for the curl binary + its libs (negligible for a daemon image).
• Version pin stays in lockstep with the step CLI version pinned in ansible/roles/step_client/defaults/main.yml. Renovate's smallstep release packageRule groups bumps across daemon + client + Ansible image pin.