Security and compliance on

Vulnerability management

Fri, 04 Sep 2026 00:00:00 +0000

How to retrieve SBOMs and attestations for Chainguard Containers

Fri, 17 Nov 2023 11:07:52 +0200

Chainguard provides a Software Bill of Materials (SBOM) with every container image, enabling complete transparency about package contents and dependencies for security and compliance requirements. These SBOMs are cryptographically signed and attached as attestations, making them retrievable and verifiable. By including only the minimum packages needed, Chainguard Containers reduce attack surface while the SBOM ensures you can verify exactly what’s in each image.

Even though they contain the minimum number of packages, there may come a time when you want to know exactly what’s running inside of a certain Chainguard Container. For this reason, Chainguard includes a signed SBOM with each image in the form of a software attestation, allowing you to verify the contents and meet compliance requirements. Chainguard publishes several different types of attestations; refer to the options under the Available attestation types section on this page.

Verifying Chainguard Containers and metadata signatures with Cosign

Mon, 18 Mar 2024 08:59:52 -0700

Chainguard signs all container images and their attestations (including SBOMs) to ensure supply chain security and enable verification of image authenticity. These cryptographic signatures allow you to confirm that images come from Chainguard and haven’t been tampered with, while attestations provide detailed information about image contents and build provenance.

This guide outlines how you can use Cosign to download and verify container image signatures and attestations.

Prerequisites

The following examples require Cosign and jq to be installed on your machine to download and verify image attestations.

STIGs for Chainguard Containers

Thu, 13 Jun 2024 15:56:52 -0700

Security Technical Implementation Guides (STIGs) trace their origin to the United States Department of Defense (DoD). They work in two layers. The Defense Information Systems Agency (DISA) publishes Security Requirements Guides (SRGs) — category-level security baselines covering technology types such as databases, web servers, or general purpose operating systems, written without vendor participation. Vendors then collaborate with DISA to produce a product-specific STIG — a formally reviewed configuration guide for a particular product, derived from the relevant SRG. If an organization runs software like MySQL 8.0 in a DoD environment, it must be configured to meet that product’s STIG. Beyond the DoD, compliance frameworks such as FedRAMP and CMMC have come to recognize STIGs as accepted security baselines.

FedRAMP technical considerations and risk factors

Wed, 29 Jan 2025 15:56:52 -0700

Many frequently asked questions revolve around how organizations are meant to stay on top of the changing landscape for FedRAMP, PMOS, Revisions, and Certificates. This article outlines various considerations and risk factors that organizations should keep in mind when working to become and stay FedRAMP authorized.

Important considerations for PMO revision trends

There are a number of things one should keep in mind when analyzing revision trends from the FedRAMP Program Management Office (PMO) — which oversees the development of the FedRAMP program — and the changes in FIPS 140-3. The following are of particular importance:

Keeping containers updated

Thu, 19 Dec 2024 08:49:15 +0000

Working with container image scanners

Mon, 17 Jun 2024 08:49:15 +0000

Policy enforcement

Tue, 02 Sep 2025 10:00:00 +0000

Chainguard Containers Security Advisories

Fri, 26 Jul 2024 18:09:12 +0000