For auditors
The evidence a ReadyStack release carries, mapped to what a SOC 2 auditor asks about, and the commands to check it yourself. ReadyStack does not make anyone compliant: it supplies evidence for the components you run, and your controls decide how you use it.
What we give you, by control
AICPA Trust Services Criteria| Criterion | What an auditor asks | What a ReadyStack release gives you | Where |
|---|---|---|---|
| CC8.1 Change management | Is each change identified, built in a controlled way and approved? | Each release is an immutable, dated tag whose release notes name the release it replaces and what changed. Its inputs are pinned: base images by digest, vendored dependencies, a fixed build timestamp. | Release notes and history: /api/releases/<slug>; the build definition in the build kit (rebuild.json, REBUILD.md) |
| CC7.1 Vulnerability detection | Are newly published vulnerabilities in these components found? | Every release on sale is scanned every day (syft and grype, scored with ce.rodeo's published rubric) and graded by Docker Scout's policy; each grade is dated with its reasons. | Products; /api/scans |
| CC7.2–CC7.4 Monitoring and response | When one is found, what happens, and is it recorded? | A release that drops below grade A goes into the build queue the same day; defects are logged publicly with how each was found and what happened to it. There is no contractual time limit: we measure detection to fixed release first. | Build queue; defect log |
| CC6.8 Unauthorized or malicious software | Can you show the software is what its publisher shipped? | Every release is signed with our published key and recorded in the public Sigstore log; it carries an SBOM and, where the release page says so, SLSA v1 build provenance; its build kit rebuilds it offline to the identical digest. | The commands below |
| CC9.2 Vendor risk | What do you rely on this vendor for, and on what terms? | Community Edition only, each product's licence named; our terms and agreement; the public evidence above, so you need not take our word for any of it. | This page |
Check it yourself
The signature, against our published key, with its transparency-log entry:
$ cosign verify --key https://readystack.dev/keys/cosign.pub readystack/<app>@sha256:<digest>
The SBOM and provenance attached to the image:
$ docker buildx imagetools inspect readystack/<app>:<tag> --format '{{json .SBOM}}' $ docker buildx imagetools inspect readystack/<app>:<tag> --format '{{json .Provenance}}'
The build, from the build kit, with the network off:
$ sha256sum -c CHECKSUMS.sha256 && ./BUILD_OFFLINE.sh && ./VERIFY_OFFLINE.sh --online
To build it on your own hardened builder with SLSA v1 provenance signed by your key, see SLSA Build Level 3.
Evidence per release
- Signature and its Sigstore log entry, SBOM, provenance where carried: on the image itself.
- First and latest scan, with counts and how it was scored:
/api/scans. - Docker Scout's output at release and today:
/api/scout-evidence/<slug>/<tag>. - Defects recorded against the release:
/api/defects?product=<slug>&release_tag=<tag>. - Release notes:
/api/releases/<slug>/<tag>/notes; whether and when the offline rebuild matched:/api/products.
All of it is public JSON, described on the API page. A single downloadable evidence pack per release is planned.
Questions reviewers ask
- Why Ubuntu 24.04, not distroless?
- Compatibility (glibc and the packages upstream projects test on), a shell and package manager when something has to be debugged, Canonical's security tracking with standard support until 2029, and you can rebuild it. It is larger than a distroless image; we chose it on purpose.
- Which platforms?
- linux/amd64 only. Every digest and rebuild we publish is for linux/amd64.
- Is there a CVE SLA?
- Not a contractual one. Every release is scanned daily and every grade is dated; one that falls below A is rebuilt from the same day. We will publish a response target once our detection-to-fix measurements support one.
- What about licences?
- Community Edition only. Each release's SBOM lists its components' licences, and Docker Scout's grade reasons count copyleft packages. A licence summary per product is planned.