Posts tagged #supply-chain
-
Why tempus.build builds its own runner image instead of using ubuntu-latest
GitHub's hosted-runner image is a VM image, not a container image, and it's built from floating versions. Here's why tempus.build builds its own: reproducibility and a verifiable supply chain, ubuntu-latest parity where it affects speed, deliberate deviations, and what the choice costs us.
-
Runner-image supply chain: how to verify the image your CI runs on
A runner image executes your code, so trust in it must be verifiable, not taken on faith. We break down the chain — digest pins, a trivy CVE gate, cosign keyless signing (Sigstore), an SBOM (CycloneDX) and SLSA provenance — and how to verify all of it yourself for tempus.build images.