aljaz/kata-containers
1
0
Fork 0
mirror of https://github.com/aljazceru/kata-containers.git synced 2025-12-19 07:14:22 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
5f7115eca880d2f3d27b15d6080c31f9ac510cd0
kata-containers/tools/osbuilder/rootfs-builder/signed-container-artifacts
History
stevenhorsman 7670792f97 osbuilder: Add PoC container signature validation 
- Add hardcoded gpg, signature and polict files
- Modify rootfs.sh to put these in the correct place in the kata image
if skopeo and umoci are being used

Fixes: #2682

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2021-11-22 11:51:05 +01:00
..
public.gpg
osbuilder: Add PoC container signature validation
2021-11-22 11:51:05 +01:00
quay_policy.json
osbuilder: Add PoC container signature validation
2021-11-22 11:51:05 +01:00
README.md
osbuilder: Add PoC container signature validation
2021-11-22 11:51:05 +01:00
signatures.tar
osbuilder: Add PoC container signature validation
2021-11-22 11:51:05 +01:00

README.md

Description

This directory provides some artifacts required for implementing and testing the kata-agent's ability to verify the signatures of container images pulled from the test quay.io/kata-containers/confidential-containers repository.

Contents

It consists of:

  • signatures.tar - a tar archive containing the signatures of quay.io/kata-containers/confidential-containers:signed and quay.io/kata-containers/confidential-containers:other_signed
  • public.gpg - the public GPG key, paired to the private key pair that was used to sign quay.io/kata-containers/confidential-containers:signed
  • quay_policy.json - a container policy file that allows insecure access to all repos except quay.io/kata-containers, in which it enforced signatures by the above key

Usage

As part of the Confidential Containers v0 proof of concept these files will be built into the kata image and used for the purposes of testing verification of signed images see Issue #2682. They are intended to be temporary whilst a better solution is found to pass them in, probably based on the attestation agent.