rotki/cla repository overview

⁠rotki/cla

A self-hosted Contributor License Agreement service for a GitHub organization. A GitHub App checks every pull request's commit authors against signed agreements and reports a commit status and a comment; contributors sign on a web page after logging in with GitHub.

• Records live as files in a mounted data directory, with names and emails encrypted with age
• Every change goes into a hash-chained audit log, anchored to Discord
• Verified, repeatable backup archives for an off-site backup job
• cla-tool inside the image for seeding, importing, verifying, rekeying and backups

Source, documentation and deployment examples: https://github.com/rotki/cla⁠

⁠Tags

• X.Y.Z, X.Y, X: releases
• latest: the newest release (pre-releases such as 1.3.0-rc.1 never move it)

Images are built for linux/amd64 and linux/arm64.

⁠Running

The image runs as user 65532 from scratch and listens on port 4000. It needs a volume at /data and the settings described in docs/deploy.md⁠. The repository has Docker Swarm⁠ and Kubernetes⁠ examples. The container works with a read-only root filesystem and all capabilities dropped.

⁠Verifying an image

Each release carries SLSA provenance and an SPDX SBOM, and its build provenance is signed through GitHub artifact attestations:

gh attestation verify oci://docker.io/rotki/cla:X.Y.Z -R rotki/cla

⁠License

AGPL-3.0-or-later, Copyright (C) 2026 Rotki Solutions GmbH.