About OSDSO
OSDSO is a small platform group. We build the pieces that sit underneath an application: the images it runs on, the pipelines that build it, and the path that puts it in front of users. Each of them is built to be verifiable.
What we build
A layered image supply chain
Hardened base images built from a verified upstream rootfs, disposable build environments, and CI tool images. Every layer is derived from the one below it.
Reusable pipeline components
Most repositories here carry a handful of lines of CI. The real logic lives in shared components, so a change lands everywhere at once.
Signed, digest-pinned artifacts
Images and artifacts are signed with keyless cosign and promoted by digest. Nothing downstream trusts a mutable tag.
A Cloudflare deployment platform
Components declare what they need; environments supply what it points at. Deployment credentials live in exactly one place.
How a deploy works
This page is deployed by that platform, so it is its own smallest example. A component publishes a signed artifact and asks infrastructure to deploy it. Only infrastructure holds Cloudflare credentials.
Principles
- Verify next to use. An artifact is checked in the same job that deploys it, so nothing can change in between.
- Declare, don't hardcode. A component names what it needs; the environment decides what that is.
- Least privilege by default. Credentials live on the one project that needs them, never at the group level.
- Fail closed. A missing binding, an unsigned artifact or an unresolved value stops the deploy rather than reaching production.
Colophon
Served from a single Cloudflare Worker with no framework, no build step and no runtime dependencies. Every byte of this page ships in the script itself, so rendering it fetches nothing.