{"id":50768773,"url":"https://github.com/trivoallan/houba","last_synced_at":"2026-06-11T16:05:12.056Z","repository":{"id":363999486,"uuid":"1265916106","full_name":"trivoallan/houba","owner":"trivoallan","description":"The single front door for external container images: harden, stamp, and trace every image you run.","archived":false,"fork":false,"pushed_at":"2026-06-11T09:06:06.000Z","size":261,"stargazers_count":0,"open_issues_count":4,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-11T09:13:53.943Z","etag":null,"topics":["cli","container-images","containers","devsecops","golden-images","harbor","image-hardening","oci","provenance","python","slsa","supply-chain-security"],"latest_commit_sha":null,"homepage":"https://github.com/trivoallan/houba","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/trivoallan.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":"docs/roadmap.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-11T07:20:37.000Z","updated_at":"2026-06-11T09:02:39.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/trivoallan/houba","commit_stats":null,"previous_names":["trivoallan/houba"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/trivoallan/houba","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trivoallan%2Fhouba","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trivoallan%2Fhouba/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trivoallan%2Fhouba/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trivoallan%2Fhouba/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/trivoallan","download_url":"https://codeload.github.com/trivoallan/houba/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trivoallan%2Fhouba/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34206555,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-11T02:00:06.485Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","container-images","containers","devsecops","golden-images","harbor","image-hardening","oci","provenance","python","slsa","supply-chain-security"],"created_at":"2026-06-11T16:05:11.120Z","updated_at":"2026-06-11T16:05:12.051Z","avatar_url":"https://github.com/trivoallan.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# houba\n\n**The single front door for the external container images your organization runs.**\n\n\u003e **Status — early development.** Foundations and I/O adapters are in place (`v0.2`); the derive-and-stamp engine and the provenance schema are the current focus ([roadmap](docs/roadmap.md)). Not yet production-ready.\n\nEvery public image that enters your registry passes through houba: it is rebuilt with your hardening policy — internal CA certificates, internal package mirrors — and stamped with **standardized, portable provenance** (OCI annotations + SLSA attestations).\n\nThe payoff lands the morning a critical CVE drops. Because every running image carries a consistent provenance stamp, *\"what's our blast radius, and who owns it?\"* becomes **one query** in the observability stack you already have — not a frantic spreadsheet. houba produces the stamp; your tools (Datadog, PowerBI, Wiz…) read it.\n\nhouba is **not** an image mirror. `skopeo sync` and Harbor replication copy images byte-for-byte. houba *transforms* them and makes them *traceable*.\n\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![Python](https://img.shields.io/badge/python-3.12-blue.svg)](https://www.python.org)\n\n---\n\n## How it works\n\nFor each image you bring in, you declare a small policy (source, tag-selection rules, hardening steps). houba then:\n\n1. Lists tags on the source registry (via `skopeo`).\n2. Selects which tags to derive — regex include/exclude filters, semver ordering, a 7-day stability window for moving digests.\n3. Rebuilds each selected image through your hardening policy (via `buildctl` / BuildKit): internal CA certificates, internal package mirrors, configurable steps.\n4. Stamps the result with standardized provenance (OCI annotations today; SLSA attestations on the roadmap).\n5. Pushes the derived image to your registry, optionally archiving superseded tags.\n6. Notifies on success / failure (Teams webhook).\n\nSee the [roadmap](docs/roadmap.md) for what is built versus planned, and the [design overview](docs/design.md) for the architecture.\n\n---\n\n## Quick start\n\n### Install\n\n`houba` is published as a Docker image bundling skopeo, BuildKit (`buildctl`), git, and the Python CLI itself:\n\n```bash\ndocker pull ghcr.io/\u003cyour-org\u003e/houba:v0-rc\n```\n\nOr from source with [uv](https://github.com/astral-sh/uv):\n\n```bash\ngit clone https://github.com/\u003cyour-org\u003e/houba.git\ncd houba\nuv sync\nuv run houba --help\n```\n\nYou still need `skopeo`, `buildctl`, and `git` on `PATH` when running from source.\n\n### Configuration\n\n`houba` reads its configuration from environment variables (12-factor). All variables are namespaced `HOUBA_*`.\n\n| Variable | Required | Default | Description |\n|---|---|---|---|\n| `HOUBA_HARBOR_URL` | yes | — | Base URL of the Harbor instance (e.g. `https://harbor.example.com`) |\n| `HOUBA_HARBOR_USER` | yes | — | Harbor robot account (e.g. `robot$houba`) |\n| `HOUBA_HARBOR_PASSWORD` | yes | — | Secret token for the robot account |\n| `HOUBA_HARBOR_PROJECT_DEFAULT` | no | — | Default Harbor project when not specified per-product |\n| `HOUBA_GITLAB_URL` | yes | — | Base URL of the GitLab instance |\n| `HOUBA_GITLAB_TOKEN` | yes | — | Personal access token (read/write API) |\n| `HOUBA_GITLAB_GROUP` | yes | — | GitLab group containing per-product repositories |\n| `HOUBA_TEAMS_WEBHOOK_URL` | no | — | Disables notifications when absent |\n| `HOUBA_LABEL_PREFIX` | no | `io.houba` | OCI label key prefix (e.g. `org.example.mirror`) |\n| `HOUBA_LOG_FORMAT` | no | `text` | `text` or `json` |\n| `HOUBA_LOG_LEVEL` | no | `INFO` | `DEBUG`, `INFO`, `WARNING`, `ERROR` |\n| `HOUBA_DRY_RUN_TAGS` | no | `false` | Skip image pushes |\n| `HOUBA_DRY_RUN_DELETIONS` | no | `false` | Skip deletions |\n| `HOUBA_WORK_DIR` | no | `/tmp/houba-work` | Scratch directory for clones/builds |\n\n### Capture production fixtures (development)\n\nTo capture a snapshot of an existing Harbor project for use in tests:\n\n```bash\nhouba dev capture --project \u003cproject\u003e --repository \u003crepository\u003e \\\n  --output tests/fixtures/captured/\n```\n\nSee [docs/runbooks/capture-fixtures.md](docs/runbooks/capture-fixtures.md).\n\n---\n\n## Architecture\n\n`houba` follows hexagonal architecture (ports \u0026 adapters):\n\n```\nhouba/\n├── domain/         pure business logic (semver, properties, tag filter, purge, plan, labels)\n├── ports/          typing.Protocol interfaces (harbor, source_registry, image_builder,\n│                   git_repo, gitlab, notifier, clock)\n├── adapters/       concrete implementations (httpx, subprocess)\n├── use_cases/      orchestration (Phase C)\n└── cli/            Typer entry points\n```\n\n**Golden rules**\n\n- `domain/` never imports I/O (no `httpx`, no `requests`, no `subprocess`).\n- `use_cases/` receive ports by constructor injection; they don't import adapters.\n- `cli/` does parsing only; everything else is delegated.\n- Environment variables are read only inside `houba/config.py`.\n\nThis makes the business logic 100% unit-testable with in-memory fakes (`tests/fakes/*`), and the adapters integration-testable in isolation with `respx` (HTTP) or fake-bin shell scripts (CLI tools).\n\n---\n\n## Development\n\n```bash\nuv sync                                       # install deps\nuv run pytest                                 # full suite\nuv run pytest tests/unit/domain --cov-fail-under=90\nuv run ruff check . \u0026\u0026 uv run ruff format --check .\nuv run mypy houba\ndocker build -t houba:dev .                   # build the runtime image\n```\n\nCurrent test coverage: **92.5 % global**, **96 % on `domain/`**.\n\n---\n\n## License\n\nApache License 2.0 — see [LICENSE](LICENSE).\n\nCopyright 2026 Tristan Rivoallan and contributors.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrivoallan%2Fhouba","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftrivoallan%2Fhouba","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrivoallan%2Fhouba/lists"}