Run it in your own cloud

Private repositories

Run it in your own cloud

The same collector, inside a Confidential VM in your own Google Cloud project. Your source never leaves your project, and the report can prove what the ordinary collector cannot: that the facts were not edited.

What it adds

A report from the ordinary collector is built from whatever facts your machine sent, and nobody can tell those from facts edited afterwards. Here the collector runs as our published image, by digest, on hardware with no shell, and asks Google to sign the exact bytes it sends. Borehole checks that signature before it scores anything, and the report carries it. A buyer can then check, without trusting us or you, that our unmodified collector produced these facts in your project.

What it does not prove

That the repository was the right one. The signature covers what the image read, not whether that was your real codebase or a cleaned-up copy. The report records the remote and the head commit it read, so a buyer can check that commit exists where they expect it.

What you need

A Google Cloud project with billing, and gcloud signed in as someone who may enable APIs and create service accounts, secrets and VMs in it.
A collector token from your account, and a key the collector can spend — add one there if you bought it under another address.
For a private repository, a read-only token for your git host.

It creates one service account that can read two secrets, and one n2d-standard-2 Confidential VM that runs once for a few minutes and is deleted. Borehole never receives credentials to your project.

Run it

Download the script and read it first. It is short, and it is all of what runs as you.

curl -fsSLO https://borehole.dev/confidential.sh
less confidential.sh

Store the two secrets in your project, typing each value at the prompt so it stays out of your shell history. The script enables Secret Manager and tells you if either is missing.

read -rs v && printf '%s' "$v" | gcloud secrets create borehole-token --project=PROJECT --data-file=- ; unset v
read -rs v && printf '%s' "$v" | gcloud secrets create repo-read-token --project=PROJECT --data-file=- ; unset v

Then run it, pinned to the collector image by digest. This is collector 0.5.0, the image this site accepts today:

bash confidential.sh \
  --project PROJECT \
  --repository https://github.com/acme/widget.git \
  --image europe-west1-docker.pkg.dev/borehole-prod/borehole-public/collector@sha256:5e9cb736a1909043301381472436210139886b4f65aa9db2cee2bb747b172d65

Pin the digest rather than a tag: a tag can move, and the signature names the digest. Compare it with collector_images at /.well-known/borehole-workload. For a public repository add --credential-secret ""; for GitLab add --credential-user oauth2, for Bitbucket x-token-auth.

It prints the report link when the VM finishes, usually within a few minutes, and deletes the VM. The VM's console, which holds the report link and counts and never your source, stays in your Cloud Logging.

What happens to your code What the collector sends, in full.