docs(verify-artifacts): fix stale image-signing table and rebrand Replicated SDK references (#1044)

reyortiz3 · claude · web-flow · commit 2700850be390 · 2026-07-17T20:45:18.000-04:00
* docs(verify-artifacts): fix stale image-signing table - Add `thv` to the _release-image.yml row — it's signed and vex-attested just like operator/proxyrunner, but was missing from the table. - Move Envoy Gateway, Envoy Ratelimit, and Presidio out of the "third-party, not re-signed" bucket into the _release-image-repackaged.yml row. Since stacklok/stacklok-enterprise-platform#2332 these are repackaged and Stacklok-signed (signature + SBOM + provenance + OpenVEX) like ai-gateway-controller/extproc, so the old guidance to check the upstream publishers' signatures instead was actively wrong. - Correct the Replicated SDK note: it isn't rewritten through image-proxy.stacklok.com at all (unlike every other image on this page) — it's pulled directly from proxy.replicated.com. It remains the only genuine third-party passthrough image. - Add thv/envoy-gateway/envoy-ratelimit/presidio-analyzer to the "verify across all images" loop. Verified live against v0.7.0 through the actual customer path (image-proxy.stacklok.com with a real license) for every image touched by this change: signature, SBOM, SLSA provenance, and OpenVEX attestations all present and valid. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs(verify-artifacts): rebrand Replicated SDK references to Stacklok License Manager The umbrella chart set nameOverride: stacklok-license-manager on the Replicated SDK subchart (stacklok/stacklok-enterprise-platform#2167), renaming its Deployment/Service in-cluster. Update the display name here to match what customers actually see via `kubectl get pods`, and note that the underlying image name/pull path are unchanged (that's the vendor's own artifact, not ours to rename). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
diff --git a/docs/platform/enterprise-platform/verify-artifacts.mdx b/docs/platform/enterprise-platform/verify-artifacts.mdx
@@ -248,32 +248,40 @@ oras discover "$IMAGE"
 
 ## Which images are signed
 
-| Image (`<IMAGE>`)                                                                   | Signing workflow                   | Verifiable |
-| ----------------------------------------------------------------------------------- | ---------------------------------- | :--------: |
-| `operator`, `proxyrunner`, `vmcp`, `registry-api`, `toolhive-enterprise`            | `_release-image.yml`               |     ✓      |
-| `ai-gateway-operator`, `ai-gateway-main-processor`, `ai-gateway-api-key-service`    | `_release-image.yml`               |     ✓      |
-| `cloud-ui`                                                                          | `_release-toolhive-cloud-ui.yml`   |     ✓      |
-| `ai-gateway-controller`, `ai-gateway-extproc`                                       | `_release-upstream-repackaged.yml` |     ✓      |
-| Third-party dependencies (Envoy Gateway, Envoy Ratelimit, Presidio, Replicated SDK) | upstream, not re-signed            |    n/a     |
+| Image (`<IMAGE>`)                                                                                      | Signing workflow                   | Verifiable |
+| ------------------------------------------------------------------------------------------------------ | ---------------------------------- | :--------: |
+| `thv`, `operator`, `proxyrunner`, `vmcp`, `registry-api`, `toolhive-enterprise`                        | `_release-image.yml`               |     ✓      |
+| `ai-gateway-operator`, `ai-gateway-main-processor`, `ai-gateway-api-key-service`                       | `_release-image.yml`               |     ✓      |
+| `cloud-ui`                                                                                             | `_release-toolhive-cloud-ui.yml`   |     ✓      |
+| `ai-gateway-controller`, `ai-gateway-extproc`, `envoy-gateway`, `envoy-ratelimit`, `presidio-analyzer` | `_release-upstream-repackaged.yml` |     ✓      |
+| Third-party dependencies (Stacklok License Manager)                                                    | upstream, not re-signed            |    n/a     |
+
+Envoy Gateway, Envoy Ratelimit, and Presidio are repackaged (re-signed with a
+Stacklok signature, SBOM, and provenance) rather than shipped as upstream
+passthrough — verify them the same way as any other image in this table. Only
+the Stacklok License Manager image remains genuine third-party passthrough.
 
 :::note[Third-party dependency images]
 
-Third-party dependency images are served through the proxy for license-gated
-distribution but are not re-signed by Stacklok. Verify those against their
-original publishers' signatures if required. They are pulled by digest, so their
-content is pinned. Their proxy paths use the upstream host, for example
-`.../proxy/stacklok-enterprise/docker.io/<UPSTREAM>/<IMAGE>`.
+The Stacklok License Manager (the in-cluster component branded from the
+Replicated SDK — it appears as `stacklok-license-manager-*` in
+`kubectl get pods`) is not re-signed by Stacklok, and unlike every other image
+on this page, it is not rewritten through `image-proxy.stacklok.com` at all — it
+is pulled directly from Replicated's own registry at
+`proxy.replicated.com/library/replicated-sdk-image`. Verify it against its
+original publisher's signature if required. It is pulled by digest, so its
+content is pinned.
 
 :::
 
-Each third-party dependency plays a specific role in the platform:
+The repackaged third-party images each play a specific role in the platform:
 
-| Dependency      | Role in the stack                                                            |
-| --------------- | ---------------------------------------------------------------------------- |
-| Envoy Gateway   | Kubernetes Gateway API data plane that fronts the AI gateway                 |
-| Envoy Ratelimit | Rate-limiting service backing the AI gateway's token budget enforcement      |
-| Presidio        | Microsoft Presidio engine for PII and PCI detection and redaction in prompts |
-| Replicated SDK  | In-cluster SDK that reports install status and license state to Replicated   |
+| Dependency               | Role in the stack                                                                                                            |
+| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
+| Envoy Gateway            | Kubernetes Gateway API data plane that fronts the AI gateway                                                                 |
+| Envoy Ratelimit          | Rate-limiting service backing the AI gateway's token budget enforcement                                                      |
+| Presidio                 | Microsoft Presidio engine for PII and PCI detection and redaction in prompts                                                 |
+| Stacklok License Manager | In-cluster component (Replicated SDK, rebranded) that reports install status and license state to Replicated (not re-signed) |
 
 ## Verify across all images
 
@@ -285,9 +293,10 @@ IDENTITY='^https://github\.com/stacklok/stacklok-enterprise-platform/\.github/wo
 ISSUER='https://token.actions.githubusercontent.com'
 VERSION='<VERSION>'
 
-for IMAGE in operator proxyrunner vmcp registry-api toolhive-enterprise cloud-ui \
+for IMAGE in thv operator proxyrunner vmcp registry-api toolhive-enterprise cloud-ui \
              ai-gateway-operator ai-gateway-main-processor ai-gateway-api-key-service \
-             ai-gateway-controller ai-gateway-extproc; do
+             ai-gateway-controller ai-gateway-extproc \
+             envoy-gateway envoy-ratelimit presidio-analyzer; do
   # Digest lookup via docker buildx (swap for `crane digest` or `oras resolve`).
   DIGEST=$(docker buildx imagetools inspect "$BASE/$IMAGE:$VERSION" \
     --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"')
