Security on

What is the Chainguard Factory?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So Dustin, can you explain what the Chainguard Factory is?

Set up and use Octo STS

Fri, 02 Oct 2026 13:51:55 +0000

Octo STS is a GitHub App that exchanges OIDC tokens from your workloads for short-lived GitHub tokens, so your automation doesn’t need personal access tokens (PATs). This page shows you how to install Octo STS, write trust policies, exchange tokens, and fix failed exchanges. For background on why Octo STS exists, read Octo STS: Short-lived GitHub tokens without PATs in Supply Chain Security 101.

How the token exchange works

Octo STS issues tokens according to trust policies that you keep in your repositories:

Workload identities and trust in Chainguard Checks

Mon, 12 Oct 2026 00:00:00 +0000

A check that must authenticate to Google Cloud or to Chainguard, such as to read a Cloud Storage bucket or to pull private images from cgr.dev, can use a workload identity: short-lived credentials that Chainguard Checks gives the check while it runs. This page explains how workload identities work, how to declare and set one up, how to limit which pull requests get one, and how to revoke access.

How workload identities work

A check’s VM holds no long-lived credentials. When a check uses a workload identity, Chainguard Checks issues the check an OpenID Connect (OIDC) token that lasts five minutes, renews the token while the check runs, and keeps the real credentials outside the VM:

Manage Chainguard Workspaces session credentials

Thu, 08 Oct 2026 00:00:00 +0000

A Chainguard Workspaces session holds no long-lived credentials: its VM stores no API keys, tokens, or registry logins. Instead, the session reaches each service through a local hostname, and the credential is added to the request outside the VM. This page explains what a session can reach by default, how to change it, and which credentials a session can’t supply.

A check in Chainguard Checks can get short-lived credentials through a workload identity, which a session can’t use. Refer to Workload identities and trust.

Guardener Commit Verification

Wed, 08 Jul 2026 00:00:00 +0000

The Commit Verification feature verifies that every commit in a pull request is cryptographically signed by an authorized signer, according to a policy you control. This ensures that changes to your codebase come from identities you trust, and it supports both keyless (Sigstore) signatures and static keys such as GPG.

Keyless commit signatures are verified using gitsign and Sigstore. Static key authorities (such as GPG) are verified directly against the key material you supply, without gitsign.

Let Chainguard Workspaces sessions act on GitHub as you

Mon, 12 Oct 2026 00:00:00 +0000

By default, a Chainguard Workspaces session reaches GitHub through the Chainguard App with access to specific repositories, as described in Manage session credentials. If you connect your GitHub account, the sessions you create afterward act on GitHub as you instead, unless your organization’s user_github policy bans it. They act through the Chainguard Develop GitHub App (chainguard-develop), which is separate from the Chainguard App that runs Chainguard Checks. A session that acts as you can do the following: