As a follow-up to my introduction of simple signing, I’m excited to announce that Red Hat is now serving signatures for Red Hat Container Catalog Images!
In May, Red Hat announced the Container Health Index, providing an aggregate safety rating for container images in our public registry. As part of our commitment to delivering trusted content, we are now serving signed images. This means that customers can now configure a Red Hat Enterprise Linux host to cryptographically verify that images have come from Red Hat when they are pulled onto the system. This is a significant step in advancing the security of container hosts, providing assurance of provenance and integrity and enabling non-repudiation. Non-repudiation simply means that the signer cannot deny their signature—a key security principle for digital transactions.
The configuration can be performed in a single command, demonstrated in this 60-second video.
http://www.youtube.com/watch?v=863Pn5m1Xks&rel=0
Atomic CLI “trust” manages the trusted registries for a host system. Here’s the command from the video:
# atomic trust add \
--pubkeys /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release \
--sigstore https://access.redhat.com/webassets/docker/content/sigstore \
registry.access.redhat.com
Let’s look at each argument of the command:
- This command is adding a new trust rule to the system.
- The trusted public key is the same key used for RPMs. It’s critical that this key is indeed Red Hat’s public key so we’re using the installed key. This key can be verified with
rpm --verify redhat-release-atomic-host
. - The signature server, or “sigstore”, is the web server that contains the signatures. Tools like docker daemon will find the signatures using the image name and digest hash.
- Trust is associated with the registry.access.redhat.com registry. Once you execute this command all images from this registry will require a signature.
The demonstration uses docker-latest, version 1.13, while an issue in docker version 1.12 is being resolved. To try this out, be sure to enable signature verification in the docker daemon. Signatures are only being applied to Red Hat's images at this time. Certified partner images in registry.connect.redhat.com are not signed at this time.
See Red Hat Enterprise Linux Atomic Host documentation and the Container Image Signing Integration Guide for more information, including how to use the atomic CLI to manage registry trust, signing images and options for distributing signatures.
À propos de l'auteur
Parcourir par canal
Automatisation
Les dernières nouveautés en matière d'automatisation informatique pour les technologies, les équipes et les environnements
Intelligence artificielle
Actualité sur les plateformes qui permettent aux clients d'exécuter des charges de travail d'IA sur tout type d'environnement
Cloud hybride ouvert
Découvrez comment créer un avenir flexible grâce au cloud hybride
Sécurité
Les dernières actualités sur la façon dont nous réduisons les risques dans tous les environnements et technologies
Edge computing
Actualité sur les plateformes qui simplifient les opérations en périphérie
Infrastructure
Les dernières nouveautés sur la plateforme Linux d'entreprise leader au monde
Applications
À l’intérieur de nos solutions aux défis d’application les plus difficiles
Programmes originaux
Histoires passionnantes de créateurs et de leaders de technologies d'entreprise