mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Johnny Greco
87929ad130
* docs: align page file names and nav labels with published URLs Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs: redirect moved dev pages and fix agent guide redirects Signed-off-by: Johnny Greco <jogreco@nvidia.com> * ci(docs): check that page URLs match their file paths Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(docs): align navigation checks with repo conventions Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs: omit historical redirect aliases Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(docs): preserve published overview and TypeScript URLs Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(docs): redirect unversioned overview and TypeScript URLs Signed-off-by: Johnny Greco <jogreco@nvidia.com> --------- Signed-off-by: Johnny Greco <jogreco@nvidia.com>
37 lines
1.5 KiB
Plaintext
37 lines
1.5 KiB
Plaintext
---
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
title: "Verify the Contents of Published OpenShell Images"
|
|
sidebar-title: "Verify Image Contents"
|
|
slug: "security/verify-image-contents"
|
|
description: "Read the SBOM attestation attached to published gateway and supervisor images to audit what each image contains."
|
|
keywords: "Generative AI, Cybersecurity, Supply Chain, SBOM, Container Images"
|
|
position: 2
|
|
---
|
|
|
|
Published gateway and supervisor images carry one SPDX SBOM per platform as OCI attestations.
|
|
|
|
## Inspect an Image
|
|
|
|
Read a platform's document without pulling the image:
|
|
|
|
```shell
|
|
docker buildx imagetools inspect ghcr.io/nvidia/openshell/gateway:latest --format '{{ json (index .SBOM "linux/amd64").SPDX }}'
|
|
```
|
|
|
|
List the packages instead of the full document:
|
|
|
|
```shell
|
|
docker buildx imagetools inspect ghcr.io/nvidia/openshell/gateway:latest --format '{{ range (index .SBOM "linux/amd64").SPDX.packages }}{{ .name }}@{{ .versionInfo }}{{ println }}{{ end }}'
|
|
```
|
|
|
|
The same commands work for `ghcr.io/nvidia/openshell/supervisor`.
|
|
|
|
## Coverage
|
|
|
|
Every SBOM lists the base-image packages. Release Dev and Release Tag images also list the Rust crates compiled into their OpenShell binary.
|
|
|
|
<Note>
|
|
OpenShell also publishes minimal SLSA provenance. It records how BuildKit produced the image, including its source revision, build platform, and base-image materials, without the extra build parameters included by full provenance.
|
|
</Note>
|