Sblurp

Verify a release

Each image is built on GitHub Actions from the public source. It comes with SLSA build provenance, an SBOM and a cosign signature. You can check that an image came from the release workflow before you run it.

With the GitHub CLI

gh attestation verify oci://ghcr.io/OWNER/sblurp-server:stable --owner OWNER

With cosign

cosign verify ghcr.io/OWNER/sblurp-server:stable \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/OWNER/[^/]+/\.github/workflows/server-release\.yml@refs/(heads/main|tags/v.+)$'

Both commands fail if the image was not built by the release workflow. Replace OWNER with the GitHub owner of the server repository.

Pin what you checked

A tag can move. To run exactly the image you checked, use its digest:

image: ghcr.io/OWNER/sblurp-server@sha256:...

A digest also stops automatic updates. See Updates and tracks.

What is in the image

  • The sblurp-server binary, built with CGO_ENABLED=0.
  • Litestream, built from source with current Go.
  • An encrypted file backup tool, from Wolfi packages, and a small start script.
  • Chainguard's wolfi-base, rebuilt every night, pinned by digest.

It runs as user 65532 and works with a read-only root filesystem.

View this page as Markdown · Glossary · API schema.json · openapi.json