Chapter 10. Open Container Initiative support

Procedure

1. Add a chart repository by entering the following command:

   $ helm repo add redhat-cop https://redhat-cop.github.io/helm-charts

2. Enter the following command to update the information of available charts locally from the chart repository:

   $ helm repo update

3. Enter the following command to pull a chart from a repository:

   $ helm pull redhat-cop/etherpad --version=0.0.4 --untar

4. Enter the following command to package the chart into a chart archive:

   $ helm package ./etherpad

   Example output

   Successfully packaged chart and saved it to: /home/user/linux-amd64/etherpad-0.0.4.tgz

5. Log in to Quay.io using helm registry login:

   $ helm registry login quay.io

6. Push the chart to your repository using the helm push command:

   helm push etherpad-0.0.4.tgz oci://quay.io/<organization_name>/helm

   Example output:

   Pushed: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:a6667ff2a0e2bd7aa4813db9ac854b5124ff1c458d170b70c2d2375325f2451b

7. Ensure that the push worked by deleting the local copy, and then pulling the chart from the repository:

   $ rm -rf etherpad-0.0.4.tgz

   $ helm pull oci://quay.io/<organization_name>/helm/etherpad --version 0.0.4

   Example output:

   Pulled: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:4f627399685880daf30cf77b6026dc129034d68c7676c7e07020b70cf7130902

Procedure

1. Enter the following go command to directly install Cosign:

   $ go install github.com/sigstore/cosign/cmd/cosign@v1.0.0

   Example output

   go: downloading github.com/sigstore/cosign v1.0.0
   go: downloading github.com/peterbourgon/ff/v3 v3.1.0

2. Generate a key-value pair for Cosign by entering the following command:

   $ cosign generate-key-pair

   Example output

   Enter password for private key:
   Enter again:
   Private key written to cosign.key
   Public key written to cosign.pub

3. Sign the key-value pair by entering the following command:

   $ cosign sign -key cosign.key quay.io/user1/busybox:test

   Example output

   Enter password for private key:
   Pushing signature to: quay-server.example.com/user1/busybox:sha256-ff13b8f6f289b92ec2913fa57c5dd0a874c3a7f8f149aabee50e3d01546473e3.sig

   If you experience the error: signing quay-server.example.com/user1/busybox:test: getting remote image: GET https://quay-server.example.com/v2/user1/busybox/manifests/test: UNAUTHORIZED: access to the requested resource is not authorized; map[] error, which occurs because Cosign relies on ~./docker/config.json for authorization, you might need to execute the following command:

   $ podman login --authfile ~/.docker/config.json quay.io

   Example output

   Username:
   Password:
   Login Succeeded!

4. Enter the following command to see the updated authorization configuration:

   $ cat ~/.docker/config.json
   {
   	"auths": {
   		"quay-server.example.com": {
   			"auth": "cXVheWFkbWluOnBhc3N3b3Jk"
   		}
   	}

Procedure

1. Enter the following go command to directly install Cosign:

   $ go install github.com/sigstore/cosign/cmd/cosign@v1.0.0

   Example output

   go: downloading github.com/sigstore/cosign v1.0.0
   go: downloading github.com/peterbourgon/ff/v3 v3.1.0

2. Generate a key-value pair for Cosign by entering the following command:

   $ cosign generate-key-pair

   Example output

   Enter password for private key:
   Enter again:
   Private key written to cosign.key
   Public key written to cosign.pub

3. Sign the key-value pair by entering the following command:

   $ cosign sign -key cosign.key quay.io/user1/busybox:test

   Example output

   Enter password for private key:
   Pushing signature to: quay-server.example.com/user1/busybox:sha256-ff13b8f6f289b92ec2913fa57c5dd0a874c3a7f8f149aabee50e3d01546473e3.sig

   If you experience the error: signing quay-server.example.com/user1/busybox:test: getting remote image: GET https://quay-server.example.com/v2/user1/busybox/manifests/test: UNAUTHORIZED: access to the requested resource is not authorized; map[] error, which occurs because Cosign relies on ~./docker/config.json for authorization, you might need to execute the following command:

   $ podman login --authfile ~/.docker/config.json quay.io

   Example output

   Username:
   Password:
   Login Succeeded!

4. Enter the following command to see the updated authorization configuration:

   $ cat ~/.docker/config.json
   {
   	"auths": {
   		"quay-server.example.com": {
   			"auth": "cXVheWFkbWluOnBhc3N3b3Jk"
   		}
   	}