> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quixa.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Supply Chain and Release Verification

> Pinned images, SBOMs, vulnerability scans, signed air-gap bundles and how Quixa keeps dependencies up to date.

# Supply Chain and Release Verification

## What a release contains

| File | Purpose |
| :- | :- |
| `quixa-images.tar.gz` | All container images, pinned versions |
| `IMAGES.txt` | Image names and digests |
| `docker/docker-compose.prod.yml`, `docker/sql/init-db.sh` | The hardened deployment the installer uses |
| `evidence/` | CycloneDX SBOM and vulnerability scan of every image, dependency audits, `SUMMARY.md` |
| `SHA256SUMS` (+ `SHA256SUMS.asc`) | Checksums of every file, optionally signed with the Quixa release key |
| `<bundle>.tar.gz.sha256` (+ `.asc`) | Checksum of the archive itself, published with the release |

### Verify before installing

```bash theme={null}
sha256sum -c quixa-enterprise-airgap-<version>.tar.gz.sha256
tar -xzf quixa-enterprise-airgap-<version>.tar.gz && cd quixa-enterprise-airgap-<version>
shasum -a 256 -c SHA256SUMS
gpg --verify SHA256SUMS.asc SHA256SUMS   # after importing the Quixa release public key
```

## Pinned images

| Image | Version |
| :- | :- |
| SQL Server | `mcr.microsoft.com/mssql/server:2022-CU27-ubuntu-22.04` |
| API runtime / build | `mcr.microsoft.com/dotnet/aspnet:9.0.22-noble` (Ubuntu 24.04) / `sdk:9.0.320` |
| Web app and script sandbox | `node:22.23.3-alpine3.24` at runtime (npm, npx and corepack removed), `bookworm-slim` for the web app build |
| Metabase | `metabase/metabase:v0.64.4` |
| Metabase setup | `alpine:3.24.2` |
| Quixa images | the release tag (`QUIXA_IMAGE_TAG`); `latest` is refused by the installer |

Builds use lock files (`npm ci`, NuGet with explicit versions). Vulnerable transitive .NET packages are pinned to patched versions in `Quixa.Core.csproj`; npm transitive fixes use `overrides`.

## SBOM and scans

`scripts/security-evidence.sh <tag>` produces, for every image, a CycloneDX SBOM and a Trivy scan (HIGH and CRITICAL), plus `dotnet list package --vulnerable` and `npm audit` results. The release gate fails when a Quixa image or dependency has a HIGH or CRITICAL finding with a fix available. Findings in third-party images (SQL Server, Metabase) are listed in `SUMMARY.md` and followed up with the vendor; they are fixed by moving to the vendor's next patched version.

Current state (Oct 30, 2026): the Quixa images (API, web app, script sandbox, Metabase setup) have **no HIGH or CRITICAL findings**. Metabase v0.64.4 has none. The SQL Server 2022 image from Microsoft (all current CU/GDR tags) contains Ubuntu 22.04 packages with HIGH findings for which Ubuntu has published updates; Microsoft rebuilds the image with them. SQL Server is not reachable from outside the Docker network. Customers who run their own SQL Server can point Quixa at it instead.

## Updates

* Base images and dependencies are reviewed with every release and at least monthly.
* Security fixes follow the patch timelines in [Privacy, incidents and patching](https://docs.quixa.io/security/privacy-and-incident-response.md).
* The script sandbox image runs its isolation tests (escape attempts, time and memory limits) during the build; an image that fails them is not produced.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.