CTFd-packaged

This repository is an internal tool to generate pre-packaged versions of CTFd.

Actually, it is used to publish the Docker image ctferio/ctfd with tag ctferio/ctfd:<CTFD-TAG>-<PLUGIN-TAG>. This image integrate our work for direct reuse, plus fits our security policies regarding traceability and auditability regarding Software Supply Chain.

It contains:

• CTFd
• CTFd-Chall-Manager

Usage

You can directly use the image ctferio/ctfd:<version> in your deployment (i.e docker-compose.yml).

Or you can build your own custom image with a Dockerfile:

FROM ctferio/ctfd:<version>

COPY your_theme /opt/CTFd/CTFd/theme/your_theme
COPY your_plugin /opt/CTFd/CTFd/plugins/your_plugin

To build it:

docker build -t org/image:tag .

Security

Signature and Attestations

For deployment purposes (and especially in the deployment case of Kubernetes), you may want to ensure the integrity of what you run.

The Docker image is SLSA 3 and can be verified using slsa-verifier using the following.

slsa-verifier slsa-verifier verify-image "ctferio/ctfd:<tag>@sha256:<digest>" \
    --source-uri "github.com/ctfer-io/ctfd" \
    --source-tag "<tag>"

Alternatives exist, like Kyverno for a Kubernetes-based deployment.

SBOMs

A SBOM is generated for the Docker image in its manifest, and can be inspected using the following.

docker buildx imagetools inspect "ctferio/ctfd:<tag>" \
    --format "{{ json .SBOM.SPDX }}"