Post B4DFs4t51qoUldPO1Q by solene@bsd.network
 (DIR) More posts by solene@bsd.network
 (DIR) Post #B4DFs4IvCHtExUUVf6 by solenepercent@bsd.network
       0 likes, 1 repeats
       
       Make your own container base images from trusted sourcesIn this article, you will learn how to create an OCI container image of Alpine or Ubuntu using a trustable base imagehttps://dataswamp.org/~solene/2026-03-12-build-your-containers-from-trusted-sources.htmlgemini://perso.pw/blog/articles/build-your-containers-from-trusted-sources.gmi#security #linux #supply-chain @solene
       
 (DIR) Post #B4DFs4eBvCu61SRUoa by Pol@mathstodon.xyz
       0 likes, 0 repeats
       
       @solenepercent @solene Thanks for the article, I have a question though. Would it be the same if the base image would have been reproducible ? I guess you're verifying the signature simply because it is *not* reproducible right ? This way we have to blindly trust its author ?
       
 (DIR) Post #B4DFs4t51qoUldPO1Q by solene@bsd.network
       0 likes, 0 repeats
       
       @solenepercent @Pol I thought mentionning reproducible builds but I forgot about it. This could help verifying if a mirror is serving trustable images but:- you need to build reproducible images to verify if the registry is lying, at this point you do not need the registry- if you trust 3rd party reproducible builds monitoring system, you would need to trust multiple independant peers. A wrong signature immediately reports an issue, not an async reproducible check
       
 (DIR) Post #B4DebndLuKdnTcO1wm by Pol@mathstodon.xyz
       0 likes, 0 repeats
       
       @solene @solenepercent Yes, that's exactly the point I had in mind: signatures prove provenance, while reproducibility reduces the amount of trust I need to place in the producer.If I only verify a signature, I am still trusting the author and the build infrastructure. If the image is reproducible, then third parties can independently confirm that the published artifact matches the declared source and inputs.So to me these are complementary: signatures answer "who gave me this ?", while reproducibility helps answer "can this claim be verified independently ?".
       
 (DIR) Post #B4Debo0kVLM8eBKiPo by solene@bsd.network
       0 likes, 0 repeats
       
       @Pol @solenepercent this is a good point indeed