Security & verification

Your data stays yours

Teleos runs on your infrastructure. It reads from GitHub with your token and stores what it reads in your database. It sends nothing to Wiglaf Software: no telemetry, no license check-in.

Every release is reproducible

Every input is pinned: Python dependencies by lockfile, base images and build tools by digest. A release built today and rebuilt tomorrow from the same tag uses the same inputs.

Two bills of materials per release

File	Contents
teleos-image-sbom.cdx.json	Everything inside the shipped container: OS packages, the Python environment, binaries (CycloneDX, generated by syft)
teleos-sbom.cdx.json	Source dependencies, including the JavaScript bundled into the UI

Both are attached to the GitHub Release and covered by the signed checksums. The container SBOM is also attached to the image as a cosign attestation.

teleos sbom          # summarize the container SBOM for your installed version
teleos sbom --app    # source dependencies
teleos sbom --path   # print the file path, e.g. to hand to your scanner

Verify signatures yourself

Releases are signed keylessly with Sigstore cosign by the release workflow. No keys to trust but the workflow’s identity.

teleos verify

Or by hand:

ID='https://github.com/TeleosApp/teleos/.github/workflows/release.yml@refs/heads/main'
ISSUER=https://token.actions.githubusercontent.com
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity "$ID" --certificate-oidc-issuer "$ISSUER"
sha256sum -c SHA256SUMS
cosign verify ghcr.io/teleosapp/teleos@<digest> \
  --certificate-identity "$ID" --certificate-oidc-issuer "$ISSUER"

Note: keyless signing records the release workflow’s identity in Sigstore’s public transparency log.