Verify what you install

Every Align release signs its container images and its Helm chart with cosign. This page shows how to check them before you deploy.

Artifact	Signed	Where the proof lives
Container images	Yes, by digest	Signature stored next to the image in the registry
Helm chart	Yes, by digest, from the first release cut after ALI-1899 merged	Signature stored next to the chart in the registry

Charts from earlier releases are unsigned. cosign verify on them fails with "no signatures found". That is expected.

The signatures are keyless. There is no Align public key to download. Each signature carries a short-lived certificate that Sigstore issued to our release workflow, and cosign verify checks who that certificate names.

What you check against

Two values, the same for the chart and every image:

	Value
Certificate identity	https://github.com/aligndottech/align-stack/.github/workflows/release.yaml@refs/tags/<release tag>
Certificate OIDC issuer	https://token.actions.githubusercontent.com

The release workflow runs on the release: published event, so the tag is part of the identity. Pin the exact tag you install. The regular expression ^https://github.com/aligndottech/align-stack/ is what the release summary prints, and it accepts a signature from any workflow in our repository. Use it only to look around, not as your policy.

Before you start

You need cosign v2 or later and the registry credentials from onboarding. Set the variables from the install guide:

export ALIGN_REGISTRY="<the registry host issued to you at onboarding>"
export ALIGN_REGISTRY_REGION="<the region issued to you at onboarding>"
export ALIGN_VERSION="<the release tag, e.g. v0.22.26>"
export ALIGN_CHART_VERSION="${ALIGN_VERSION#v}"
export ALIGN_IDENTITY="https://github.com/aligndottech/align-stack/.github/workflows/release.yaml@refs/tags/${ALIGN_VERSION}"
export ALIGN_ISSUER="https://token.actions.githubusercontent.com"

cosign reads the Docker credential store, not Helm's. Log in with Docker even if you only verify the chart:

aws ecr get-login-password --region "$ALIGN_REGISTRY_REGION" | \
  docker login "$ALIGN_REGISTRY" --username AWS --password-stdin

Verify the chart

Signatures bind to a digest, so resolve the digest of the version you will install, then verify that digest:

CHART_DIGEST=$(docker buildx imagetools inspect \
  "$ALIGN_REGISTRY/align/charts/align:$ALIGN_CHART_VERSION" --format '{{.Manifest.Digest}}')

cosign verify "$ALIGN_REGISTRY/align/charts/align@$CHART_DIGEST" \
  --certificate-identity "$ALIGN_IDENTITY" \
  --certificate-oidc-issuer "$ALIGN_ISSUER"

Success prints the checks cosign ran and a JSON payload. Failure exits non-zero.

A tag can be repointed after you verify it. To keep what you verified and what you install identical, record the chart digest and re-resolve it immediately before helm install. If the two differ, stop.

Verify the images

All images for a release share the release tag. This loop checks the same list the install guide mirrors.

for image in gateway brain ui migrations connector-slack connector-github \
             connector-jira connector-confluence connector-zoom connector-teams \
             connector-align connector-linear connector-notion \
             connector-azure-devops connector-m365-documents \
             connector-google-drive connector-google-meet; do
  digest=$(docker buildx imagetools inspect \
    "$ALIGN_REGISTRY/align/$image:$ALIGN_VERSION" --format '{{.Manifest.Digest}}')
  cosign verify "$ALIGN_REGISTRY/align/$image@$digest" \
    --certificate-identity "$ALIGN_IDENTITY" \
    --certificate-oidc-issuer "$ALIGN_ISSUER" >/dev/null \
    && echo "ok      $image $digest" \
    || echo "FAILED  $image $digest"
done

The release job summary in GitHub Actions lists every signed image with its digest. GitHub expires job summaries, so do not rely on it as a long-term record. Keep the digests you verified.

If you mirror images to your own registry, verify before you mirror, against Align's registry. Copying a manifest by digest keeps the digest, but the signature is a separate artifact in the registry and does not travel unless you copy it. cosign copy copies the image and its signature together.

Get the SBOMs and the scan report

Each release publishes its evidence as one signed archive in the same registry as the chart. It holds every image's CycloneDX SBOM, the Trivy vulnerability report for the released digests, and a list of those digests. The release notes carry the exact oras pull command. The release notes link it from the first release cut after ALI-1931 merged; earlier releases have no archive.

The tag is the chart version plus -evidence. Verify the signature on its digest, as for the chart, then pull it:

EVIDENCE_DIGEST=$(docker buildx imagetools inspect \
  "$ALIGN_REGISTRY/align/charts/align:${ALIGN_CHART_VERSION}-evidence" --format '{{.Manifest.Digest}}')

cosign verify "$ALIGN_REGISTRY/align/charts/align@$EVIDENCE_DIGEST" \
  --certificate-identity "$ALIGN_IDENTITY" \
  --certificate-oidc-issuer "$ALIGN_ISSUER"

oras pull "$ALIGN_REGISTRY/align/charts/align@$EVIDENCE_DIGEST"
tar -xzf release-evidence-${ALIGN_VERSION}.tar.gz
(cd release-evidence-${ALIGN_VERSION} && sha256sum -c SHA256SUMS)

digests.txt lists the image digests the reports describe. The Trivy reports cover fixable HIGH and CRITICAL findings, minus the exceptions in .trivyignore; they are the scan run before the release retag, on the same digests. The scan is vulnerabilities only: it does not look for secrets or misconfiguration. The offline bundle carries the same SBOMs and reports under sbom/ and trivy/.

What this does not prove

A valid signature proves the artifact came out of Align's release workflow for that tag. It does not prove the code is free of vulnerabilities, and it says nothing about charts or images you have modified or rebuilt.