Security
Everything needed to check us is published.
Every release is signed. Your cluster refuses to admit an image that is not — a policy that fails closed, so an outage of the policy engine refuses pods rather than admitting unverified ones.
Verifying a release
The key below is the same one the admission policy verifies against, so a signature enforced inside your cluster is one you can check from outside it.
curl -fsSLO https://qa.ugix.io/.well-known/cosign.pub
cosign verify-blob --key cosign.pub --bundle install.yaml.bundle \
--insecure-ignore-tlog=true install.yaml--insecure-ignore-tlog is required, and it is not an oversight. This project signs without a transparency log, so there is no log entry to check. The flag says so out loud rather than hiding it.
Check you have the right key
A key you downloaded from a page is only as good as your confidence that the page was ours. So the fingerprint is written here, in the page, where it can be compared against what you fetched — and against what you were given six months ago.
SHA-256 (base64) Zh7CC2dYbkJBVL9ZDo74jTQ/q8y1wysowpx2dq9gU04=
SHA-256 (hex) 661ec20b67586e424154bf590e8ef88d343fabccb5c32b28c29c7676af60534eComputed over the key’s DER encoding, which is what you can reproduce:
openssl pkey -pubin -in cosign.pub -outform DER | openssl dgst -sha256 -binary | base64The same value appears as the publicKey.hint in every signature bundle we publish, so a bundle names the key that signed it and you can check that it is this one.
What a verified signature proves
That the file is byte-for-byte what the holder of the private key signed. Nothing more.
It does not prove when the signature was made. Without a transparency log, a signature made with a stolen key is indistinguishable from a legitimate one until that key is rotated. That limit is stated here rather than left for you to discover.
Reporting a vulnerability
Reports go to security@ugix.io, and they are answered. The disclosure policy states the response times we commit to, the safe harbour for good-faith research, and how coordinated disclosure is handled.
Your data is not here to lose
The system runs on infrastructure you own. Your operational data stays inside your boundary; there is no copy of it on our side to be breached, and no shared database holding several customers’ records.