Skip to content
This repository has been archived by the owner on Jun 22, 2024. It is now read-only.

Commit

Permalink
Update image-verification.md (#23)
Browse files Browse the repository at this point in the history
Signed-off-by: caroldelwing <[email protected]>
  • Loading branch information
caroldelwing authored Jan 9, 2024
1 parent 7396c46 commit 456fbf1
Showing 1 changed file with 6 additions and 12 deletions.
18 changes: 6 additions & 12 deletions docs/image-verification.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,8 @@
The Spectromate container image is signed using [Sigstore's](https://sigstore.dev/) Cosign. The container image is signed using a cryptographic key pair that is private and stored internally. The public key is available in the official Spectro Cloud documentation repository at [**static/cosign.pub**](https://raw.githubusercontent.com/spectrocloud/librarium/master/static/cosign.pub). Use the public key to verify the authenticity of the container image. You can learn more about the container image signing process by reviewing the [Signing Containers](https://docs.sigstore.dev/signing/signing_with_containers) documentation page.


:::info

Cosign generates a key pair that uses the ECDSA-P256 algorithm for the signature and SHA256 for hashes. The keys are stored in PEM-encoded PKCS8 format.

:::
> [!NOTE]
> Cosign generates a key pair that uses the ECDSA-P256 algorithm for the signature and SHA256 for hashes. The keys are stored in PEM-encoded PKCS8 format.

Use the following command to verify the authenticity of the container image. Replace the image tag with the version you want to verify.
Expand All @@ -20,7 +17,7 @@ ghcr.io/spectrocloud/spectromate:v1.0.7
If the container image is valid, the following output is displayed. The example output is formatted using `jq` to improve readability.

```shell hideClipboard
Verification for ghcr.io/spectrocloud/librarium:nightly --
Verification for ghcr.io/spectrocloud/spectromate:v1.0.7 --
The following checks were performed on each of these signatures:
- The cosign claims were validated
- Existence of the claims in the transparency log was verified offline
Expand Down Expand Up @@ -56,11 +53,8 @@ The following checks were performed on each of these signatures:
```


:::danger

Do not use the container image if the authenticity cannot be verified. Verify you downloaded the correct public key and that the container image is from `ghcr.io/spectrocloud/spectromate`.

:::
> [!CAUTION]
> Do not use the container image if the authenticity cannot be verified. Verify you downloaded the correct public key and that the container image is from `ghcr.io/spectrocloud/spectromate`.
If the container image is not valid, an error is displayed. The following example shows an error when the container image is not valid.

Expand All @@ -87,4 +81,4 @@ zFEMG++p4q8Mf+y2gp7Ae4oUaXk6Q9V7aVjjltRVN6SQcoSASxf2H2EpgA==
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYHrc2WIE3apKLmcxlFFHyVQCQZWh
2+al5W/VMlPr3u4EZ/V/GOBm6+Y9gF3Us3twueXYgdYeFo5o7BUn70MPPw==
-----END PUBLIC KEY-----
```
```

0 comments on commit 456fbf1

Please sign in to comment.