diff --git a/docs/my-website/blog/ci_cd_v2_improvements/index.md b/docs/my-website/blog/ci_cd_v2_improvements/index.md index 84f8f7bda6b..4ad4446e536 100644 --- a/docs/my-website/blog/ci_cd_v2_improvements/index.md +++ b/docs/my-website/blog/ci_cd_v2_improvements/index.md @@ -27,6 +27,27 @@ Building on the roadmap from our [security incident](https://docs.litellm.ai/blo - Validation and release are separated into different repositories, making it harder for an attacker to reach release credentials. - Trusted Publishing for PyPI releases - this means no long-lived credentials are used to publish releases. - Immutable Docker release tags - this means no tampering of Docker release tags after they are published [Learn more](https://docs.docker.com/docker-hub/repos/manage/hub-images/immutable-tags/). Note: work for GHCR docker releases is planned as well. +- Docker image signing with [Cosign](https://github.com/sigstore/cosign) - all release images are signed so users can independently verify they came from us. + +## Verify Docker image signatures + +All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). To verify the integrity of an image before deploying: + +```bash +cosign verify \ + --key https://raw.githubusercontent.com/BerriAI/litellm//cosign.pub \ + ghcr.io/berriai/litellm: +``` + +Replace `` with the version you are deploying (e.g. `v1.83.0-stable`). + +Expected output: + +``` +The following checks were performed on each of these signatures: + - The cosign claims were validated + - The signatures were verified against the specified public key +``` ## What's next diff --git a/docs/my-website/blog/security_townhall_updates/index.md b/docs/my-website/blog/security_townhall_updates/index.md index b997de9c185..5f5f1954f33 100644 --- a/docs/my-website/blog/security_townhall_updates/index.md +++ b/docs/my-website/blog/security_townhall_updates/index.md @@ -145,6 +145,25 @@ This will ensure, your releases are safe, even when: We believe that [Cosign](https://github.com/sigstore/cosign) is a good fit for this, and have already begun working on it [PR](https://github.com/BerriAI/litellm/pull/24683). +#### How to verify a Docker image with Cosign + +All LiteLLM Docker images are now signed with [cosign](https://docs.sigstore.dev/cosign/overview/). To verify the integrity of an image before deploying: + +```bash +cosign verify \ + --key https://raw.githubusercontent.com/BerriAI/litellm//cosign.pub \ + ghcr.io/berriai/litellm: +``` + +Replace `` with the version you are deploying (e.g. `v1.83.0-stable`). + +Expected output: + +``` +The following checks were performed on each of these signatures: + - The cosign claims were validated + - The signatures were verified against the specified public key +``` ### Avoid Compromised Packages diff --git a/docs/my-website/blog/security_update_march_2026/index.md b/docs/my-website/blog/security_update_march_2026/index.md index 1c298fe372f..a175b59829b 100644 --- a/docs/my-website/blog/security_update_march_2026/index.md +++ b/docs/my-website/blog/security_update_march_2026/index.md @@ -708,6 +708,26 @@ The LiteLLM AI Gateway team has already taken the following steps: - Engaged Google's Mandiant security team to assist with forensic analysis of the build and publishing chain +## Verify Docker image signatures + +All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). To verify the integrity of an image before deploying: + +```bash +cosign verify \ + --key https://raw.githubusercontent.com/BerriAI/litellm//cosign.pub \ + ghcr.io/berriai/litellm: +``` + +Replace `` with the version you are deploying (e.g. `v1.83.0-stable`). + +Expected output: + +``` +The following checks were performed on each of these signatures: + - The cosign claims were validated + - The signatures were verified against the specified public key +``` + ## Verified safe versions We have audited every LiteLLM release published between v1.78.0 and v1.82.6 across both PyPI and Docker. Each artifact was verified by: