cosign

Sun, 27 Apr 2025 17:07:08 +0200

set up new keys Link to heading

$ set -x COSIGN_PASSWORD (pwgen -sy 16 1)
$ cosign --verbose generate-key-pair
Private key written to cosign.key
Public key written to cosign.pub

sign an image Link to heading

$ docker pull registry.mkz.me/mycroft/golang-cdk8s
$ cosign sign --key cosign.key (docker inspect registry.mkz.me/mycroft/golang-cdk8s | jq -r .[0].RepoDigests[0]) --tlog-upload=false
Pushing signature to: registry.mkz.me/mycroft/golang-cdk8s

Note: to add tags, just -a: -a author="Patrick MARIE"

verify an image Link to heading

cosign verify --key cosign.pub  (docker inspect registry.mkz.me/mycroft/golang-cdk8s | jq -r .[0].RepoDigests[0]) --private-infrastructure=true

Verification for registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

[{"critical":{"identity":{"docker-reference":"registry.mkz.me/mycroft/golang-cdk8s"},"image":{"docker-manifest-digest":"sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817"},"type":"cosign container image signature"},"optional":{"author":"Patrick MARIE"}}]

notation

Sun, 27 Apr 2025 17:07:08 +0200

Create testing certificate Link to heading

$ notation cert generate-test --default "registry.mkz.me"
generating RSA Key with 2048 bits
generated certificate expiring on 2025-04-18T19:04:06Z
wrote key: /home/mycroft/.config/notation/localkeys/registry.mkz.me.key
wrote certificate: /home/mycroft/.config/notation/localkeys/registry.mkz.me.crt
Successfully added registry.mkz.me.crt to named store registry.mkz.me of type ca
registry.mkz.me: added to the key list
registry.mkz.me: mark as default signing key

Listing certificates Link to heading

$ notation cert list
STORE TYPE   STORE NAME        CERTIFICATE
ca           registry.mkz.me   registry.mkz.me.crt

$ notation key ls
NAME                KEY PATH                                                       CERTIFICATE PATH                                               ID   PLUGIN NAME
* registry.mkz.me   /home/mycroft/.config/notation/localkeys/registry.mkz.me.key   /home/mycroft/.config/notation/localkeys/registry.mkz.me.crt

Signing an image Link to heading

$ notation sign registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
Successfully signed registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817

$ notation ls registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
└── application/vnd.cncf.notary.signature
    ├── sha256:d5f4495b9f5d73054764fd6933dc5efb1312129ac0762a5fecf026116b167d0a
    └── sha256:e9e0feffe6c92690a6997c469a1e3ea3ce7ac9d8a122c1203892893065faf612

Verifying the image Link to heading

Create a trustpolicy to be used: Link to heading

$ cat trustpolicy.json
{
    "version": "1.0",
    "trustPolicies": [
        {
            "name": "trust-policy-example",
            "registryScopes": [ "*" ],
            "signatureVerification": {
                "level" : "strict"
            },
            "trustStores": [ "ca:registry.mkz.me" ],
            "trustedIdentities": [
                "*"
            ]
        }
    ]
}

$ cp trustpolicy.json ~/.config/notation/

Verify the signature Link to heading

$ notation sign registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
Successfully signed registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817

$ notation verify registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
Successfully verified signature for registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817

OCI on mkz.me

cosign

set up new keys Link to heading

sign an image Link to heading

verify an image Link to heading

notation

Create testing certificate Link to heading

Listing certificates Link to heading

Signing an image Link to heading

Verifying the image Link to heading

Create a trustpolicy to be used: Link to heading

Verify the signature Link to heading