Skip to content

Latest commit

 

History

History
21 lines (17 loc) · 1.92 KB

README.md

File metadata and controls

21 lines (17 loc) · 1.92 KB
Melange Orb

CircleCI Melange Orb

An orb for simplifying Melange installation and use within CircleCI.

CircleCI Build Status CircleCI Orb Version GitHub License CircleCI Community

This is an unofficial Melange orb used for installing Melange in your CircleCI pipeline to build packages for distroless container images. Contributions are welcome!

Features

Secure By Design

  • Least Privilege: Installs to a user-owned directory by default, with no sudo usage anywhere in this orb.
  • Integrity: Checksum validation of all downloaded binaries using SHA-512.
  • Provenance: Installs directly from Melange's official releases page on GitHub. No third-party websites, domains, or proxies are used.
  • Confidentiality: All secrets and environment variables are handled in accordance with CircleCI's security recommendations and best practices.
  • Privacy: No usage data of any kind is collected or shipped back to the orb developer.

Info for security teams:

  • Required external access to allow, if running a locked down, self-hosted CircleCI pipeline on-prem:
    • github.com: For download and installation of the Melange tool.