Artifact Signing

View product develop

All PowerAuth Cloud Docker images are signed using Cosign. Each image also has an attached Software Bill of Materials (SBOM) in CycloneDX format, expect the init image.

Verify the Docker Image Signature

To verify that a Docker image has been signed by Wultra, run:

wget https://raw.githubusercontent.com/wultra/wultra-infrastructure/refs/heads/develop/public-keys/cosign.pub
cosign verify \
    --key cosign.pub \
    wultra.jfrog.io/wultra-docker/powerauth-cloud:${VERSION}

Download and Inspect the SBOM

To download the attached SBOM:

cosign download attestation \
    wultra.jfrog.io/wultra-docker/powerauth-cloud:${VERSION} \
    | jq -r '.dsseEnvelope.payload' | base64 -d | jq '.predicate'

To verify the SBOM attestation signature before trusting it:

wget https://raw.githubusercontent.com/wultra/wultra-infrastructure/refs/heads/develop/public-keys/cosign.pub
cosign verify-attestation \
    --key cosign.pub \
    --type cyclonedx \
    wultra.jfrog.io/wultra-docker/powerauth-cloud:${VERSION}

Last updated on May 05, 2026 (09:31) View product