Supply Chain Security for Liquibase Secure Docker Images

Key points:

• New supply chain security features for Liquibase Secure Docker images starting with version 5.1
• Software Bill of Materials (SBOM) attached to every image for complete dependency visibility
• SLSA Level 3 build provenance attestation for reproducible, verifiable builds
• Cryptographic image signing via Cosign with keyless GitHub OIDC authentication
• Zero private keys stored—signatures use ephemeral certificates from Sigstore's public transparency log
• Available on all registries: Docker Hub, GitHub Container Registry (GHCR), and Amazon ECR Public

Introduction

Software supply chain attacks have become one of the most significant security threats facing organizations today. From the SolarWinds compromise to attacks targeting open-source package repositories, the industry has learned that trusting software requires more than just trusting its source code—it requires verifying the entire build and distribution pipeline.

We're excited to announce that starting with Liquibase Secure 5.1, our Docker images now include comprehensive supply chain security features: Software Bill of Materials (SBOM), SLSA Level 3 build provenance, and cryptographic image signing. These capabilities give security and compliance teams the tools they need to verify image authenticity, audit dependencies, and meet increasingly stringent regulatory requirements.

Why Supply Chain Security Matters

Modern container deployments rely on a chain of trust that extends from source code through build systems to container registries. A compromise at any point in this chain can introduce vulnerabilities or malicious code into production environments. Supply chain security addresses this by providing:

Transparency: Know exactly what's in your container images and where they came from.

Verification: Cryptographically prove that images haven't been tampered with since they were built.

Compliance: Meet audit requirements for SOC 2, FedRAMP, and other frameworks that mandate supply chain controls.

Incident Response: Quickly identify affected deployments when vulnerabilities are discovered in dependencies.

What's New in Liquibase Secure 5.1

Software Bill of Materials (SBOM)

Every Liquibase Secure image now includes a complete SBOM listing all packages, libraries, and dependencies. This inventory enables security teams to:

• Identify vulnerable components when CVEs are announced
• Audit third-party dependencies for license compliance
• Track transitive dependencies that might otherwise go unnoticed
• Automate vulnerability scanning with tools that consume SBOM data

The SBOM is attached directly to the image as an attestation, meaning it travels with the image through your CI/CD pipeline and into production.

SLSA Level 3 Build Provenance

Supply-chain Levels for Software Artifacts (SLSA, pronounced "salsa") is a security framework that defines levels of supply chain integrity. Our images now include SLSA Level 3 provenance attestations, which provide:

• Non-falsifiable provenance: Cryptographic proof of the build process that cannot be forged
• Isolated build environment: Builds run in GitHub Actions with no ability for build scripts to influence the provenance
• Source integrity: Verification that the image was built from the expected source repository and commit

This means you can verify not just what's in an image, but exactly how and where it was built.

Cryptographic Image Signing with Cosign

All Liquibase Secure images are now signed using Cosign with keyless signing via GitHub OIDC. This approach provides:

• No private key management: Signatures use ephemeral certificates issued by Sigstore's Fulcio CA
• Public transparency: All signatures are recorded in Sigstore's Rekor transparency log
• Identity verification: Signatures are bound to the GitHub Actions workflow identity, proving the image was built by Liquibase's official CI/CD pipeline

Unlike traditional signing approaches that require secure key storage and rotation, keyless signing eliminates the risk of key compromise while providing stronger identity guarantees.

Verifying Liquibase Secure Images

Security features are only valuable if they can be verified. Here's how to validate Liquibase Secure images in your environment:

Verify Image Signature

Use Cosign to verify that an image was signed by Liquibase's official build pipeline:

cosign verify liquibase/liquibase-secure:5.1.0 --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity-regexp="https://github.com/liquibase/docker/.*"

A successful verification confirms:

• The image was built by a GitHub Actions workflow in the liquibase/docker repository
• The signature was recorded in Sigstore's public transparency log
• The image has not been modified since signing

View Software Bill of Materials

The SBOM is attached as an OCI attestation manifest. To view it:

1. First, inspect the image to find attestation manifests:

docker buildx imagetools inspect liquibase/liquibase-secure:5.1.0

2. Look for manifests with Platform: unknown/unknown and vnd.docker.reference.type: attestation-manifest
3. Inspect the attestation to confirm SBOM exists:

docker buildx imagetools inspect liquibase/liquibase-secure:5.1.0@<ATTESTATION_DIGEST> --raw | jq '.layers[] | annotations["[in-toto.io/predicate-type](http://in-toto.io/predicate-type)"]'

4. Expected output:
   
   • "https://spdx.dev/Document"
   • "https://slsa.dev/provenance/v0.2"
5. To extract the full SBOM, use oras:

oras blob fetch liquibase/liquibase-secure:5.1.0@<SBOM_LAYER_DIGEST> --output sbom.json
jq '.predicate.packages[] | {name, version: .versionInfo}' sbom.json

View Build Provenance

Examine the build provenance to understand exactly how an image was created:

docker buildx imagetools inspect liquibase/liquibase-secure:5.1.0 --format '{{ json .Provenance }}'

The provenance includes:

• The source repository and commit SHA
• The GitHub Actions workflow that performed the build
• Build timestamps and environment details
• The builder identity and build configuration

Compliance and Standards

These supply chain security features support compliance with several industry frameworks and standards:

SLSA Level 3

Our build process meets SLSA Level 3 requirements:

• Build Platform: GitHub Actions provides a hardened, hosted build environment
• Provenance Generation: Build provenance is generated automatically by the build platform, not by user-defined build scripts
• Provenance Verification: Provenance attestations are signed and can be independently verified

SOC 2 Type II

The supply chain controls support SOC 2 requirements in several areas:

• Change Management: Provenance provides an audit trail for all image builds
• System Operations: SBOMs enable monitoring and vulnerability management
• Risk Assessment: Complete dependency visibility supports security assessments

Container Security Best Practices

These features align with recommendations from NIST, CISA, and the Cloud Native Computing Foundation (CNCF) for securing container supply chains.

What This Means for Your Organization

For Security Teams

You now have cryptographic proof of image integrity and complete visibility into image contents. Integrate signature verification into your deployment pipelines to ensure only authorized images reach production.

For Compliance Teams

SBOMs and provenance attestations provide the documentation auditors need to verify supply chain controls. These artifacts are machine-readable and can be automatically collected for audit evidence.

For DevOps Teams

These features work transparently—no changes to your existing workflows are required. Images are signed and attested during the build process, and verification can be added to your deployment gates when you're ready.

Technical Implementation

For those interested in the technical details, here's how we implemented these features:

Build Pipeline Changes

We modified our GitHub Actions release workflow to enable SBOM and provenance generation in the docker/build-push-action:

- name: Build and push Docker image
  uses: docker/build-push-action@v6
    with:
    sbom: true
    provenance: mode=max
    # ... additional configuration

Cosign Integration

Image signing happens automatically after each successful build:

- name: Install Cosign
  uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
- name: Sign imagn
  run: |
    cosign sign --yes liquibase/liquibase-secure@${{steps.build.outputs.digest }}

The --yes flag enables keyless signing with GitHub OIDC, and the digest reference ensures we sign exactly the image that was just built.

Registry Support

Signed images with SBOM and provenance attestations are available on all our supported registries:

• Docker Hub: liquibase/liquibase-secure
• GitHub Container Registry: ghcr.io/liquibase/liquibase-secure
• Amazon ECR Public: public.ecr.aws/liquibase/liquibase-secure

Scope and Availability

These supply chain security features apply exclusively to Liquibase Secure images. Community/OSS images (liquibase/liquibase) are not affected by these changes and continue to be built and distributed as before.

This focused approach allows us to deliver enterprise-grade security features to customers with strict compliance requirements while maintaining the simplicity of our community offering.

Getting Started

Supply chain security features are available now in Liquibase Secure 5.1 and later. To start using them:

1. Pull the latest Liquibase Secure image from your preferred registry
2. Verify the signature using the Cosign command above
3. Integrate verification into your pipeline by adding signature checks to your deployment process
4. Export SBOMs for vulnerability scanning and compliance documentation

Looking Forward

This release represents our commitment to providing enterprise-grade security for database DevOps. Supply chain security is an ongoing journey, and we'll continue enhancing these capabilities based on evolving standards and customer feedback.

The DevOps team at Liquibase serves as the subject matter experts for container security and CI/CD integration. For questions about implementing these features in your environment, reach out through our standard support channels.

FAQ

Q: Do these features affect Liquibase Community/OSS images? A: No. SBOM, provenance, and signing are exclusive to Liquibase Secure images. Community images are unchanged.

Q: Do I need to change my deployment process? A: No changes are required. Signed images work exactly like unsigned images. You can add signature verification to your pipeline when you're ready, but it's not mandatory.

Q: What tools can consume the SBOM data? A: The SBOM is generated in SPDX format, which is supported by most vulnerability scanners and software composition analysis (SCA) tools, including Snyk, Grype, Trivy, and others.

Q: How do I verify signatures in air-gapped environments? A: Keyless verification requires network access to Sigstore's services. For air-gapped environments, contact our support team to discuss alternative verification approaches.

Q: What happens if signature verification fails? A: A failed verification indicates the image may have been tampered with or was not built by Liquibase's official pipeline. Do not deploy images that fail verification.  Contact Liquibase support at support@liquibase.com.

Q: Are older Liquibase Secure versions signed? A: No. Supply chain security features are available starting with Liquibase Secure 5.1. Earlier versions do not include SBOM, provenance, or signatures.