Spitfirev1.0.0 · What's new

Version: 1.0.0This documentation is for Spitfire 1.0.0.

Security and release verification

Every Spitfire release comes with a "trust pack": what is inside the software (SBOM), a scan report for known vulnerabilities and signatures for the files. Your security team can run its own checks with these before installing Spitfire.

What is published

The files are next to the installer bundle, under https://spitfire.tr/download/ (<version> for example 1.0.0):

File What
spitfire-<version>-source.spdx.json SBOM of the source code, in SPDX format (Go modules, the web UI's npm packages)
spitfire-<version>-source.cdx.json The same SBOM in CycloneDX format
spitfire-<version>-image.spdx.json / .cdx.json SBOM of the server image (usespitfire/spitfire:<version>, linux/amd64)
spitfire-<version>-image-browser…, -image-updater…, -image-collector… SBOMs of the browser, updater and Collector images
spitfire-<version>-<name>.vulns.json The vulnerability scan report for each SBOM
<file>.sigstore.json The file's cosign signature
cosign.pub The public key to verify the signatures with

The images on Docker Hub are signed too, and their CycloneDX SBOM is attached to the image as an attestation.

Note

The source and the images are scanned before a release is published; a critical vulnerability stops the release. A finding that is accepted (no fix exists, or it comes from code Spitfire does not use) is recorded in the repository with its reason and does not appear in the report.

Verifying an image

On a machine with cosign:

bash
curl -fsSLO https://spitfire.tr/download/cosign.pub
cosign verify --key cosign.pub usespitfire/spitfire:1.0.0

The output says the signature was verified; with no signature, or one made with another key, the command fails. To get the image's SBOM together with its signature:

bash
cosign verify-attestation --key cosign.pub --type cyclonedx usespitfire/spitfire:1.0.0 > attestation.json

Verifying the installer bundle and other files

bash
V=1.0.0
curl -fsSLO https://spitfire.tr/download/spitfire-$V.tar.gz
curl -fsSLO https://spitfire.tr/download/spitfire-$V.tar.gz.sigstore.json
cosign verify-blob --key cosign.pub --bundle spitfire-$V.tar.gz.sigstore.json spitfire-$V.tar.gz

The same command works for install.sh, install.ps1, the offline bundles (spitfire-offline-<version>-linux-amd64.tar.gz) and the SBOM files: append .sigstore.json to the file's name.

Scanning the SBOM with your own tool

The SBOM is in a standard format; give it to the scanner your organisation uses. For example:

bash
grype sbom:spitfire-1.0.0-image.cdx.json

Our report (.vulns.json) was made with the database at release time; rescan the SBOM yourself for vulnerabilities announced later.

The product's own signatures

Apart from the trust pack, Spitfire updates are already signed:

  • The release list (releases.json) is signed; a controller refuses an unsigned or altered list.
  • The runner distribution carries a signed SHA256SUMS; runners update themselves only from a signed list.
  • The installer bundle's .sha256 checksum is published with it.

Reporting a vulnerability

If you found a security vulnerability, e-mail the details to support@usespitfire.com with "Security" in the subject line. Reports are answered by e-mail.