We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ref cnabio/cnab-to-oci#101
$ signy --tlscacert=$NOTARY_CA --server https://localhost:4443 sign testdata/cnab/bundle.json localhost:5000/test-no-tag INFO[0000] Starting to copy image cnab/helloworld:0.1.1 INFO[0001] Completed image cnab/helloworld:0.1.1 copy INFO[0001] Generated relocation map: relocation.ImageRelocationMap{"cnab/helloworld:0.1.1":"localhost:5000/test-no-tag@sha256:a59a4e74d9cc89e4e75dfb2cc7ea5c108e4236ba6231b53081a9e2506d1197b6"} INFO[0002] Pushed successfully, with digest "sha256:b4936e42304c184bafc9b06dde9ea1f979129e09a021a8f40abc07f736de9268" INFO[0002] Pushed trust data for localhost:5000/test-no-tag: c7e92bd51f059d60b15ad456edf194648997d739f60799b37e08edafd88a81b5
This generates the following targets file - notice the empty key for the target:
{ "signed": { "_type": "Targets", "delegations": { "keys": {}, "roles": [] }, "expires": "2023-03-12T11:59:53.535554-07:00", "targets": { "": { "hashes": { "sha256": "x+kr1R8FnWCxWtRW7fGUZImX1zn2B5mzfgjtr9iKgbU=", "sha512": "VgQ/Bcy/5IGpguFN65K5hUPM324iFO3jyDLEfFO5RcVzdSilkHhDIJemRxADrWDSX2AVM8qrjTqZg7BRbxt61g==" }, "length": 501 } }, "version": 4 }, "signatures": [ { "keyid": "afed30445b655dc441c973959a740a4bb7f7154f077a8464ba717ab4d28477b3", "method": "ecdsa", "sig": "f5hGpvJpGFzZn0/34HrfcZaUGZET+q37x708EwrrQRNK+K0/9TGL2aPv5MIeYCR37Qpch5My+B1NFCA2dzJ9Ng==" } ] }
Listing the repository:
$ signy --tlscacert=$NOTARY_CA --server https://localhost:4443 list localhost:5000/test-no-tag c7e92bd51f059d60b15ad456edf194648997d739f60799b37e08edafd88a81b5
Trying to verify:
$ signy --tlscacert=$NOTARY_CA --server https://localhost:4443 verify localhost:5000/test-no-tag INFO[0000] Pulled trust data for localhost:5000/test-no-tag, with role targets - SHA256: c7e92bd51f059d60b15ad456edf194648997d739f60799b37e08edafd88a81b5 INFO[0000] Pulling bundle from registry: localhost:5000/test-no-tag Error: cannot pull bundle: failed to resolve bundle manifest "localhost:5000/test-no-tag": object require
The underlying error here is coming from cnab-to-oci, but the decision to disallow pushing without a tag can must also be taken here as well.
cnab-to-oci
Trying to verify using the full SHA256:
$ signy --tlscacert=$NOTARY_CA --server https://localhost:4443 verify localhost:5000/test-no-tag@sha256:b4936e42304c184bafc9b06dde9ea1f979129e09a021a8f40abc07f736de9268 INFO[0000] Pulled trust data for localhost:5000/test-no-tag@sha256:b4936e42304c184bafc9b06dde9ea1f979129e09a021a8f40abc07f736de9268, with role targets - SHA256: c7e92bd51f059d60b15ad456edf194648997d739f60799b37e08edafd88a81b5 INFO[0000] Pulling bundle from registry: localhost:5000/test-no-tag@sha256:b4936e42304c184bafc9b06dde9ea1f979129e09a021a8f40abc07f736de9268 INFO[0000] Computed SHA: c7e92bd51f059d60b15ad456edf194648997d739f60799b37e08edafd88a81b5 INFO[0000] The SHA sums are equal: c7e92bd51f059d60b15ad456edf194648997d739f60799b37e08edafd88a81b5
The text was updated successfully, but these errors were encountered:
For reference, the Docker CLI behaviour here is to also disallow signing an image without tag:
https://github.com/docker/cli/blob/ef2f64abbd37edfa148f745fa0013731b5074d1b/cli/command/trust/sign.go#L131-L140
Sorry, something went wrong.
Sounds like a good idea to me!
No branches or pull requests
ref cnabio/cnab-to-oci#101
This generates the following targets file - notice the empty key for the target:
Listing the repository:
Trying to verify:
The underlying error here is coming from
cnab-to-oci
, but the decision to disallow pushing without a tag can must also be taken here as well.Trying to verify using the full SHA256:
The text was updated successfully, but these errors were encountered: