Blog
Engineering notes, security advisories, and announcements.
-
CI/CD integration cookbook — Forgejo, GitLab CI, generic shell
Published · Rasid
Worked examples for pulling, verifying, pinning by digest, and consuming the advisory feed in three CI runtimes. No GitHub Actions example by owner directive — generic shell covers that case.
-
Zero CVE on release — what it actually means, and where its limits are
Published · Rasid
What 'zero CVE at the moment of build' actually guarantees, how the daily rebuild absorbs the moving target, what the advisory.json feed is, and the edge cases where you still need to act.
-
Introducing Rasid hardened container images
Published · Fahad
Apache 2.0 licensed, zero-CVE, signed and attested container images. Free to pull, free to redistribute.
-
How to verify a Rasid image
Published · Fahad
A practical guide — pull, cosign verify against fulcio.rasid.cc + rekor.rasid.cc, inspect the SBOM, validate the SLSA attestation.
-
Why Apache 2.0 hardened images
Published · Fahad
What you get when the image binary is Apache 2.0, the signature chain is self-hosted, and the build pipeline is operated by a single vendor accountable end-to-end.