Support for signature stored in official repositories

[stremovsky]

Hi

This cosign project (https://github.com/sigstore/cosign) supports storing of signatures in regular docker repositories.

It is doing it by creating an additional container label named by file signature digest.

You can also add support for this method.

Example:
index.docker.io/stremovsky/my_busybox:sha256-dca71257cd2e72840a21f0323234bb2e33fea6d949fa0f21c5102146f583486b.sig

More info can be found here:
https://blog.sigstore.dev/cosign-image-signatures-77bab238a93

Best regards,
Yuli

---

https://databunker.org/

[rjbrown57]

+1

[dbilling]

+1 ... Considering cosign appears to be getting alot of traction, including from RedHat experts (e.g. Luke Hinds, RedHat Security Engineering Lead, Office of the CTO), I'm surprised that Portieris has not already adopted it as an additional choice for signature verification. docker content trust and simple signing both seem quite long in the tooth...