Skip to content

Commit 66acc47

Browse files
ggguardianggguardian
committed
pgvector: add images
1 parent 6f13c07 commit 66acc47

File tree

11 files changed

+248
-0
lines changed

11 files changed

+248
-0
lines changed

‎.github/workflows/pgvector.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: pgvector
2+
3+
on:
4+
schedule:
5+
- cron: "00 01 * * 1-5"
6+
push:
7+
branches:
8+
- 'main'
9+
paths:
10+
- .github/workflows/pgvector.yaml
11+
- 'images/pgvector/*.yaml'
12+
workflow_dispatch:
13+
14+
permissions:
15+
contents: read
16+
packages: write
17+
attestations: write
18+
id-token: write
19+
security-events: write
20+
actions: read
21+
22+
jobs:
23+
publish:
24+
strategy:
25+
matrix:
26+
version: [latest, "17", "16"]
27+
variant: [prod, dev]
28+
name: ${{ matrix.version }}${{ matrix.variant == 'shell' && '-shell' || matrix.variant == 'dev' && '-dev' || '' }}
29+
uses: './.github/workflows/release.yaml'
30+
with:
31+
tag: ${{ matrix.version }}${{ matrix.variant == 'shell' && '-shell' || matrix.variant == 'dev' && '-dev' || '' }}
32+
target: ${{ format('{0}/{1}', matrix.version, matrix.variant) }}
33+
secrets: inherit

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
| [minio-bitnami-client](./images/minio-bitnami-client/) | `docker pull ghcr.io/gitguardian/wolfi/minio-bitnami-client` |
3333
| [nginx](./images/nginx/) | `docker pull ghcr.io/gitguardian/wolfi/nginx` |
3434
| [node](./images/node/) | `docker pull ghcr.io/gitguardian/wolfi/node` |
35+
| [pgvector](./images/pgvector/) | `docker pull ghcr.io/gitguardian/wolfi/pgvector` |
3536
| [prometheus](./images/prometheus/) | `docker pull ghcr.io/gitguardian/wolfi/prometheus` |
3637
| [prometheus-adapter](./images/prometheus-adapter/) | `docker pull ghcr.io/gitguardian/wolfi/prometheus-adapter` |
3738
| [python](./images/python/) | `docker pull ghcr.io/gitguardian/wolfi/python` |

‎images/pgvector/16/dev.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include: images/pgvector/dev.yaml

‎images/pgvector/16/prod.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
include: images/pgvector/prod.yaml
2+
3+
contents:
4+
packages:
5+
- pgvector-16
6+
- postgresql-16
7+
- postgresql-16-client
8+
- postgresql-16-oci-entrypoint

‎images/pgvector/17/dev.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include: images/pgvector/dev.yaml

‎images/pgvector/17/prod.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
include: images/pgvector/prod.yaml
2+
3+
contents:
4+
packages:
5+
- pgvector-17
6+
- postgresql-17
7+
- postgresql-17-client
8+
- postgresql-17-oci-entrypoint

‎images/pgvector/README.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# PGVector
2+
3+
Minimal Python image based on Wolfi.
4+
5+
## Versions
6+
7+
| 📌 Version | ⬇️ Pull URL |
8+
| ---------- | --------------------------------------------- |
9+
| latest | ghcr.io/gitguardian/wolfi/pgvector:latest |
10+
| latest-dev | ghcr.io/gitguardian/wolfi/pgvector:latest-dev |
11+
| 17 | ghcr.io/gitguardian/wolfi/pgvector:17 |
12+
| 17-dev | ghcr.io/gitguardian/wolfi/pgvector:17-dev |
13+
| 16 | ghcr.io/gitguardian/wolfi/pgvector:16 |
14+
| 16-dev | ghcr.io/gitguardian/wolfi/pgvector:16-dev |
15+
16+
## ✅ Verify the Provenance
17+
18+
GitHub CLI ([gh](https://cli.github.com/)) can be used to retrieve the build provenance, which details the exact commit, workflow, and runner that produced the image:
19+
20+
- **Production image**
21+
22+
```shell
23+
gh attestation verify \
24+
--owner gitguardian \
25+
oci://ghcr.io/gitguardian/wolfi/pgvector:latest
26+
```
27+
28+
- **Shell image**
29+
30+
```shell
31+
gh attestation verify \
32+
--owner gitguardian \
33+
oci://ghcr.io/gitguardian/wolfi/pgvector:latest-shell
34+
```
35+
36+
## 📦 **Image Verification**
37+
38+
All official images are **cryptographically signed** using [Sigstore Cosign](https://www.sigstore.dev/).
39+
40+
### ✅ Verify the Image Signature
41+
42+
To ensure the image is authentic and has not been tampered with, use the following command:
43+
44+
- **Production image**
45+
46+
```shell
47+
cosign verify \
48+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
49+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
50+
ghcr.io/gitguardian/wolfi/pgvector:latest | jq
51+
```
52+
53+
- **Shell image**
54+
55+
```shell
56+
cosign verify \
57+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
58+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
59+
ghcr.io/gitguardian/wolfi/pgvector:latest-shell | jq
60+
```
61+
62+
### 📦 **Image SBOMs**
63+
64+
To enhance transparency, we generate SBOMs for each release. SBOMs are available directly from the container registry
65+
and can be verified using using [Sigstore Cosign](https://www.sigstore.dev/).
66+
67+
#### ✅ Verify the Image Attestations
68+
69+
- **Production image**
70+
71+
```shell
72+
cosign verify-attestation \
73+
--type=https://spdx.dev/Document \
74+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
75+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
76+
ghcr.io/gitguardian/wolfi/pgvector:latest
77+
```
78+
79+
- **Shell image**
80+
81+
```shell
82+
cosign verify-attestation \
83+
--type=https://spdx.dev/Document \
84+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
85+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
86+
ghcr.io/gitguardian/wolfi/pgvector:latest-shell
87+
```
88+
89+
This will pull in the signature for the attestation specified by the --type parameter, which in this case is the SPDX attestation. You will receive output that verifies the SBOM attestation signature in cosign's transparency log:
90+
91+
```shell
92+
Verification for ghcr.io/gitguardian/wolfi/pgvector:latest --
93+
The following checks were performed on each of these signatures:
94+
- The cosign claims were validated
95+
- Existence of the claims in the transparency log was verified offline
96+
- The code-signing certificate was verified using trusted certificate authority certificates
97+
Certificate subject: https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main
98+
Certificate issuer URL: https://token.actions.githubusercontent.com
99+
GitHub Workflow Trigger: push
100+
GitHub Workflow SHA: ced6b3cfab1341509de55bff7c0389ce81f73aae
101+
GitHub Workflow Name: pgvector
102+
GitHub Workflow Repository: GitGuardian/wolfi
103+
GitHub Workflow Ref: refs/heads/main
104+
...
105+
```
106+
107+
#### ✅ Download the Image SBOM Attestations
108+
109+
To download an attestation, use the `cosign` download attestation command and provide both the predicate type and the build platform. For example, the following command will obtain the SBOM for the pgvector image on `linux/amd64`:
110+
111+
- **Production image**
112+
113+
```shell
114+
cosign download attestation \
115+
--platform=linux/amd64 \
116+
--predicate-type=https://spdx.dev/Document \
117+
ghcr.io/gitguardian/wolfi/pgvector:latest | jq -r .payload | base64 -d | jq .predicate
118+
```
119+
120+
- **Shell image**
121+
122+
```shell
123+
cosign download attestation \
124+
--platform=linux/amd64 \
125+
--predicate-type=https://spdx.dev/Document \
126+
ghcr.io/gitguardian/wolfi/pgvector:latest-shell | jq -r .payload | base64 -d | jq .predicate
127+
```

‎images/pgvector/dev.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
include: images/pgvector/prod.yaml
2+
3+
contents:
4+
packages:
5+
- apk-tools
6+
- build-base
7+
- curl
8+
- git
9+
- vim
10+
- wolfi-keys
11+
12+
accounts:
13+
run-as: root

‎images/pgvector/latest/dev.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include: images/pgvector/17/dev.yaml

‎images/pgvector/latest/prod.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include: images/pgvector/17/prod.yaml

0 commit comments

Comments
 (0)