Chapter 8. Signing container images

Procedure

1. Generate a sigstore public or private key pair:

   $ skopeo generate-sigstore-key --output-prefix myKey.private

2. Add the following content to the /etc/containers/registries.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

   You can edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. You can also edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory.

   All YAML files are read and the filename can be arbitrary. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d/ directory.

3. Build the container image by using a Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

4. Sign the image and push it to the registry:

   $ podman push --sign-by-sigstore-private-key ./myKey.private <registry>/<namespace>/<image>

   The podman push command pushes the <registry>/<namespace>/<image> local image to the remote registry as <registry>/<namespace>/<image>. The --sign-by-sigstore-private-key option adds a sigstore signature by using the myKey.private private key to the <registry>/<namespace>/<image> image. The image and the sigstore signature are uploaded to the remote registry.

   Note

   If you need to sign existing images while moving them across container registries, you can use the skopeo copy command.

   For more details, see podman-push(1) and podman-build(1) man pages on your system.

Procedure

1. Add the following content to the /etc/containers/registries.conf.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

   You can edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d/ directory. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d/ directory.

   You can also edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. Please note that all YAML files are read and the filename is arbitrary.

2. Create the /etc/containers/registries.d/file.yml file:

   fulcio:
     fulcioURL: "https://<your-fulcio-server>"
     oidcMode: "interactive"
     oidcIssuerURL: "https://<your-OIDC-provider>"
     oidcClientID: "sigstore"
   rekorURL: "https://<your-rekor-server>"

   The file.yml is the sigstore signing parameter YAML file used to store options required to create sigstore signatures.

3. Sign the image and push it to the registry:

   $ podman push --sign-by-sigstore=file.yml <registry>/<namespace>/<image>

   You can alternatively use the skopeo copy command with similar --sign-by-sigstore options to sign existing images while moving them across container registries.

   Warning

   Note that your submission to public servers includes the public key, the certificate, and signature metadata.

   For more information, see the containers-sigstore-signing-params.yaml, podman-push(1) and container-registries.d man pages on your system.

Procedure

1. Generate a sigstore public or private key pair:

   $ skopeo generate-sigstore-key --output-prefix myKey.private

   The public and private keys myKey.pub and myKey.private are generated.

2. Add the following to the /etc/containers/registries.conf.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

   Note

   You can edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d/ directory. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d/ directory. You can also edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. Please note that all YAML files are read and the filename is arbitrary.

3. Build the container image by using a Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

4. Create the /etc/containers/registries.d/file.yml file:

   privateKeyFile: "/home/user/sigstore/myKey.private"
   privateKeyPassphraseFile: "/mnt/user/sigstore-myKey.private-passphrase"
   rekorURL: "https://<your-rekor-server>"

   The file.yml is the sigstore signing parameter YAML file used to store options required to create sigstore signatures.

5. Sign the image and push it to the registry:

   $ podman push --sign-by-sigstore=file.yml <registry>/<namespace>/<image>

   You can alternatively use the skopeo copy command with similar --sign-by-sigstore options to sign existing images while moving them across container registries.

   Warning

   Note that your submission for public servers includes data about the public key and metadata about the signature.

Procedure

1. Generate a GPG key:

   # gpg --full-gen-key

2. Export the public key:

   # gpg --output <path>/key.gpg --armor --export <username@example.com>

3. Build the container image by using a Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

   Replace <registry>, <namespace>, and <image> with the container image identifiers.

4. Sign the image and push it to the registry:

    $  podman push \
       --sign-by <username@example.com> \
       <registry>/<namespace>/<image>

   Note

   If you need to sign existing images while moving them across container registries, you can use the skopeo copy command.

5. Optional: Display the new image signature:

   # (cd /var/lib/containers/sigstore/; find . -type f)
   ./<image>@sha256=<digest>/signature-1

6. Copy your local signatures to the lookaside web server:

   # rsync -a /var/lib/containers/sigstore <user@registry-lookaside.example.com>:/registry-lookaside/webroot/sigstore

   The signatures are stored in the location determined by the lookaside-staging option, in this case, /var/lib/containers/sigstore directory.