Verify Replicated component artifacts
This topic describes the verification material that Replicated publishes for its components, and where to find the steps to verify each type of artifact.
Overview
Replicated publishes signatures, Supply Chain Levels for Software Artifacts (SLSA) provenance, and software bills of materials (SBOMs) for its components. You and your customers can use this material to confirm that an artifact was built by Replicated and has not been modified, and to review the components that it contains.
What Replicated publishes depends on the component and the type of artifact. Use the following table to find the verification steps for the artifact that you have. All of the procedures use Cosign.
Verification by artifact
| Component | Artifact | SBOM | Signature | SLSA provenance |
|---|---|---|---|---|
| Replicated SDK | Container image: replicated-sdk-image | Yes | Yes | Yes |
| Embedded Cluster v3 | Release archive and installer binary, in releases 3.14.0-beta.1 and later | Yes | Release archive, installer binary | Release archive, installer binary |
| Troubleshoot | preflight and support-bundle CLI archives | Yes | Not available | Yes, in releases 0.134.1 and later |
| Troubleshoot | Container images: troubleshoot and preflight, in releases 0.132.2 and later | Yes | Yes | Yes |
| KOTS | KOTS CLI release archive | Yes | Not available | Not available |
| KOTS | Container images: kotsadm, kotsadm-migrations, and kurl-proxy | Yes | Yes | Yes |
| kURL | kURL release files | Yes | Not available | Not available |
Choose a procedure
The verification steps are grouped by type of artifact:
-
Release archives and files that you download:
- For more information about verifying the signatures and SLSA provenance of Embedded Cluster v3 release files, see Validate Embedded Cluster v3 release files.
- For more information about verifying SLSA provenance for the Troubleshoot CLI archives, see Validate Troubleshoot CLI provenance.
- For more information about verifying the SBOM signature for an Embedded Cluster v3, Troubleshoot, KOTS, or kURL release, see Validate SBOM signatures.
-
Container images: For more information about verifying SLSA provenance, image signatures, and SBOM attestations for Replicated SDK, Troubleshoot, and KOTS images, see Validate container image provenance.