Chapter 4. Verifying Red Hat signatures

Procedure

1. Download Red Hat’s product signing keys from the Customer Portal for the products you want to verify. This downloads a text file containing Red Hat’s public key signature.

2. Open a terminal on your workstation. Download the Rekor public key, and create a new rekor.pem file:

   $ curl https://REKOR_HOSTNAME/api/v1/log/publicKey > rekor.pem

3. Create a new cosign public key from the Red Hat product signing key:

   $ cat 63405576.txt > cosign.pub

4. Configure your shell environment for cosign to use the new Rekor public key:

   $ export SIGSTORE_REKOR_PUBLIC_KEY=rekor.pem

5. Verify a Red Hat signed image by using the cosign public key:

   cosign verify --key cosign.pub IMAGE_NAME:TAG

   $ cosign verify --key cosign.pub registry.redhat.io/rhelai1/granite-3.1-8b-starter-v1:latest