dev-image

This repository contains all my development packages preinstalled inside a Container image built using Vib.

Using the Container Image with Distrobox

Type the following command to create an container of this image in Distrobox:

distrobox create -n dev -i ghcr.io/kbdharun/dev-image:main

Tip

To create a rootful container, add the --root flag to the above command (i.e. distrobox create -n dev -i ghcr.io/kbdharun/dev-image:main --root).

Type the following command to enter the container:

distrobox enter dev

Verify the Container Image using Cosign

To verify the container image using cosign (download the cosign.pub file from here and execute the following command):

cosign verify --key cosign.pub ghcr.io/kbdharun/dev-image:main

Verify Image Build Provinance Attestation

All the image builds/pushes are attested for provenance and integrity using actions/attest-build-provenance. They can be verfied by downloading the recent bundle from the attestations page and having the latest version of GitHub CLI installed in your system. Then, execute the following command:

gh attestation verify oci://ghcr.io/kbdharun/dev-image --owner kbdharun --bundle <path/to/attestation_file.sigstore.json>

Note

Replace the <path/to/attestation_file.sigstore.json> placeholder with the actual path to the downloaded attestation file.