Signed Images from the Red Hat Container Catalog

As a follow-up to my introduction of simple signing, I’m excited to announce that Red Hat is now serving signatures for Red Hat Container Catalog Images!

In May, Red Hat announced the Container Health Index, providing an aggregate safety rating for container images in our public registry. As part of our commitment to delivering trusted content, we are now serving signed images. This means that customers can now configure a Red Hat Enterprise Linux host to cryptographically verify that images have come from Red Hat when they are pulled onto the system. This is a significant step in advancing the security of container hosts, providing assurance of provenance and integrity and enabling non-repudiation. Non-repudiation simply means that the signer cannot deny their signature—a key security principle for digital transactions.

The configuration can be performed in a single command, demonstrated in this 60-second video.

http://www.youtube.com/watch?v=863Pn5m1Xks&rel=0

Atomic CLI “trust” manages the trusted registries for a host system. Here’s the command from the video:

# atomic trust add \
--pubkeys /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release \
--sigstore https://access.redhat.com/webassets/docker/content/sigstore \
registry.access.redhat.com

Let’s look at each argument of the command:

1. This command is adding a new trust rule to the system.
2. The trusted public key is the same key used for RPMs. It’s critical that this key is indeed Red Hat’s public key so we’re using the installed key. This key can be verified with rpm --verify redhat-release-atomic-host.
3. The signature server, or “sigstore”, is the web server that contains the signatures. Tools like docker daemon will find the signatures using the image name and digest hash.
4. Trust is associated with the registry.access.redhat.com registry. Once you execute this command all images from this registry will require a signature.

The demonstration uses docker-latest, version 1.13, while an issue in docker version 1.12 is being resolved. To try this out, be sure to enable signature verification in the docker daemon. Signatures are only being applied to Red Hat's images at this time. Certified partner images in registry.connect.redhat.com are not signed at this time.

See Red Hat Enterprise Linux Atomic Host documentation and the Container Image Signing Integration Guide for more information, including how to use the atomic CLI to manage registry trust, signing images and options for distributing signatures.