timothyswan/vale-source repository overview

Vale⁠ prose / style linter. This is the from-source Tier 1 variant — built ourselves on hi/go:latest-builder rather than consuming the upstream-shipped pre-built binary. The sibling vale image (Tier 2 binary) is the canonical vale; this image is the CVE-cleaner alternative.

⁠Why a separate image

The Tier 2 binary vale image is built from the upstream-published vale_3.14.2_Linux_64-bit.tar.gz tarball. That binary's Go stdlib version is whatever Go shipped when the vale maintainers cut the release — and there's no way for us to change it. When a Go stdlib CVE drops (e.g., CVE-2026-27143, fixed in go1.25.9 / 1.26.2), the upstream binary stays vulnerable until vale maintainers cut a NEW release rebuilt on patched Go.

vale-source builds Vale from source on hi/go:latest-builder (Go 1.26.3 as of v1.58.0) — Go version we control via the monthly RHHI rebuild cadence. When a Go stdlib patch ships, the next monthly rebuild picks it up and Vale rebuilds against the patched Go automatically.

⁠Trade-off

The CGO + tree-sitter dependency means this image's build is heavier than other Tier 1 Go tools:

• The Containerfile installs gcc-c++ + glibc-static + libstdc++-static via microdnf so g++ can compile the bundled tree-sitter C/C++ parsers.
• Build flags include -linkmode=external -extldflags=-static so the final binary is fully static and runs on hi/core-runtime distroless without glibc / libstdc++ at runtime.
• Build time: ~5 minutes (vs ~30 seconds for the Tier 2 binary download).
• Resulting binary: ~42 MB (vs ~25 MB for the upstream-stripped binary).

The behavioral surface is identical — vale-source consumes the same .vale.ini configs and produces the same JSON/CLI output as the Tier 2 binary.

⁠Usage

# Run vale against a directory mounted at /repo
podman run --rm -v "$(pwd):/repo:ro,Z" --workdir /repo vale-source:<version>-rhhi --output=JSON path/to/file.md

Identical CLI surface to the Tier 2 vale image.

⁠Supply chain

• Base images: registry.access.redhat.com/hi/go:latest-builder (build) → registry.access.redhat.com/hi/core-runtime (runtime — distroless)
• Built from: upstream github.com/errata-ai/vale.git at v3.14.2 (commit 810868b21c6c88cf78dfb8960b1afc78d1b7f6a8)
• Tier: 1 (Go from source, CGO_ENABLED=1 with static link) — vs the sibling vale image which is Tier 2 (upstream binary release)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation

⁠Companion

The Tier 2 vale image stays as the canonical vale build, currently shipping with SCAN_FAIL_SEVERITY: "none" (warn-only) on its grype gate because the upstream binary carries CVE-2026-27143. Once vale-source proves itself in production use, the Tier 2 build can be retired or the warn-only override removed.