Package: docker-sign-verify
docker-sign-verifyOverviewA utility that can be used to create and verify embedded signatures in docker images, and verify the integrity of image metadata and layers.The goal of this utility is to operate directly on Docker Registries (v2).FeaturesVerifies and signs files in place; no need to replicate images using docker-cli.Extensible signing technologies; built-in support for GnuPG and PKI.Integrates with the docker credentials store.InstallationFrompypi.org$ pip install docker_sign_verifyFrom source code$gitclonehttps://github.com/crashvb/docker-sign-verify
$cddocker-sign-verify
$virtualenvenv
$sourceenv/bin/activate
$python-mpipinstall--editable.[dev]UsageSigning and verifying an imageUsing master key with id7DDD762AFCDF1E55and sukey with id9DD1BB948581B0AD:$gpg--keyid-formatLONG--list-keys7DDD762AFCDF1E55
pubrsa4096/7DDD762AFCDF1E552017-11-30[SC][expires:2027-11-28]uid[ultimate]RichardDavis<crashvb>
subrsa4096/9DD1BB948581B0AD2017-11-30[S][expires:2027-11-28]Resolve the tagcrashvb/base:ubuntuin a remote registryregistry:5000, verify all layers, and sign the digest of the
canonicalized configuration. Then, upload a new manifest containing the embedded signatures, and assign it the tagcrashvb/base:ubuntu_signed.$dsv--debugsign--keyid="7DDD762AFCDF1E55"registry:5000/crashvb/base:ubunturegistry:5000/crashvb/base:ubuntu_signed
Keypass[]:
INFO:root:Signing:registry:5000/crashvb/base:ubuntu...
INFO:root:VerifyingIntegrity:registry:5000/crashvb/base:ubuntu...
DEBUG:root:configdigest:sha256:8ff76ab7ecbe0...424bf93cacad083c0
DEBUG:root:manifestlayers:sha256:3b37166ec6145...4e6a6e7580cdeff8esha256:504facff238fd...ddc52d31448a044bdsha256:ebbcacd28e101...73bf796e12b1bb449sha256:c7fb3351ecad2...042086fe72c902b8asha256:2e3debadcbf7e...eca27cb4d809d56c2sha256:a5396a146776f...4e30f97ed2e9891a4sha256:6389d93ef5c7f...243609c6f41637e84sha256:e05442215521c...fbdadc15c5c80294fsha256:f4ed07aa21a9b...f1fd5a4095bf575c9sha256:e41e7b47a71d3...4611b5ed003208f81sha256:ae19c1f4b6b19...b28fef2632aca9064
DEBUG:root:imagelayers:sha256:8823818c47486...45be9ba0eb149a643sha256:19d043c86cbcb...da1e8fc6ce1e43d7fsha256:883eafdbe580e...50cad1875e13e3915sha256:4775b2f378bb7...91719367c739ef25asha256:75b79e19929ce...1ee48b949261770cfsha256:440c82316bee2...ed8d2c3f168299db8sha256:0538f6ef1ac4c...4cb5a61b9bd530929sha256:090cbbe4fbc62...25f7322fb5cd1d619sha256:5b42cc22f7bd7...4492f3790f05fccbcsha256:ffd252d089fe6...b41e7336a18e12c8asha256:22681af0cc030...ca77af16b6bfeb204
INFO:root:Integritycheckpassed.
DEBUG:root:Signature:
-----BEGINPGPSIGNATURE-----

iQIcBAABCgAGBQJcW2I9AAoJEJ3Ru5SFgbCtfW0QAJO4WCS/0hPwby3RpIYxSZ74
dcr7lRccsH7afdEuFXp5SlxXBL8gXyfEAcmUcuwzhapGdBPntWXqf10R3tq9Bx0j
36AOwZGt+vSCGdvOz6MEyCgS/JBXXGAUt3L0ciB4dCh/Un2ANSqQ1g+vT2zhHoL5
HggzDTaddawU8sSGhIj/fR62+ari5xWIXs2Vn3+wTjrdiQ6G3W2cb64LWTCYo2sH
qenDO4Z3AkdzRMT10Z4IqkU2XjHQiqIJhdcdJMnF+JZU8pbzmKDyXLE5JOt8Dx39
R2G4AUNXA9vQClYBShAUSTSB2nMRd2fX2GWd/jKgn0mvLa3a+V27VmYW/jQGRWHW
qlJsh0WUBeVQjLGpf+zqknhAXnNmm5ZIvCYqPVJ3PAR6BGi7luzk9s2wBgzlDbED
JCaFka6U1b/YAAc+PTs6Am4N0bGS1p9r7GWb+i7PFWTwH/H5D1MDXDgDNyjE52Qh
DyXgcaJBnQbu2T6BbzYY2WSyvjPWVOkwQGb2lpBKrO7Y1w7T7VMlTVloI+hPWfSs
5VxmfyFNJFHq5Iqo1N76W1/mSDPxv6qF3NOxvK+rMsoqqGJ7/BR8RB4jueeXTgLf
Yr0rnXDsuKbNmh88x/GPg+xbf3m2nVv9kB0F5vhb9J756rlwb1A8+RDVDRs5ICLF
m7KvRvDb7+zZvnur5lTu=voGn
-----ENDPGPSIGNATURE-----
DEBUG:root:configdigest(signed):sha256:d9e31c5898fe25bb7b3ac86f8570b8961d5d878aace796920a9da3f8cd8251cb
INFO:root:Creatednewimage:registry:5000/crashvb/base:ubuntu_signedResolve the tagcrashvb/base:ubuntu_signedin a remote registryregistry:5000, verify all layers and embedded
signatures.$dsv--debugverifyregistry:5000/crashvb/base:ubuntu_signed
INFO:root:VerifyingIntegrity:registry:5000/crashvb/base:ubuntu_signed...
DEBUG:root:configdigest:sha256:d9e31c5898fe2...20a9da3f8cd8251cb
DEBUG:root:manifestlayers:sha256:3b37166ec6145...4e6a6e7580cdeff8esha256:504facff238fd...ddc52d31448a044bdsha256:ebbcacd28e101...73bf796e12b1bb449sha256:c7fb3351ecad2...042086fe72c902b8asha256:2e3debadcbf7e...eca27cb4d809d56c2sha256:a5396a146776f...4e30f97ed2e9891a4sha256:6389d93ef5c7f...243609c6f41637e84sha256:e05442215521c...fbdadc15c5c80294fsha256:f4ed07aa21a9b...f1fd5a4095bf575c9sha256:e41e7b47a71d3...4611b5ed003208f81sha256:ae19c1f4b6b19...b28fef2632aca9064
DEBUG:root:imagelayers:sha256:8823818c47486...45be9ba0eb149a643sha256:19d043c86cbcb...da1e8fc6ce1e43d7fsha256:883eafdbe580e...50cad1875e13e3915sha256:4775b2f378bb7...91719367c739ef25asha256:75b79e19929ce...1ee48b949261770cfsha256:440c82316bee2...ed8d2c3f168299db8sha256:0538f6ef1ac4c...4cb5a61b9bd530929sha256:090cbbe4fbc62...25f7322fb5cd1d619sha256:5b42cc22f7bd7...4492f3790f05fccbcsha256:ffd252d089fe6...b41e7336a18e12c8asha256:22681af0cc030...ca77af16b6bfeb204
INFO:root:Integritycheckpassed.
INFO:root:VerifyingSignature(s):registry:5000/crashvb/base:ubuntu_signed...
DEBUG:root:configdigest(signed):sha256:d9e31c5898fe2...20a9da3f8cd8251cb
DEBUG:root:configdigest(unsigned):sha256:8ff76ab7ecbe0...424bf93cacad083c0
DEBUG:root:signtures:
DEBUG:root:Signaturemade2019-02-0622:39:57usingkeyID9DD1BB948581B0AD
DEBUG:root:RichardDavis<crashvb>
INFO:root:Signaturecheckpassed.Replicate both images to a local repository$dockerpullregistry:5000/crashvb/base:ubuntu
ubuntu:Pullingfromcrashvb/base
3b37166ec614:Downloadcomplete504facff238f:Downloadcompleteebbcacd28e10:Downloadcompletec7fb3351ecad:Downloadcomplete2e3debadcbf7:Downloadcompletea5396a146776:Downloadcomplete6389d93ef5c7:Downloadcompletee05442215521:Downloadcompletef4ed07aa21a9:Downloadcompletee41e7b47a71d:Downloadcompleteae19c1f4b6b1:DownloadcompleteDigest:sha256:8acac09a29bb9364dca10cce18e7d2fd4f83cb495a8519af585b56bcfeba03ca
Status:Downloadednewerimageforregistry:5000/crashvb/base:ubuntu$dockerpullregistry:5000/crashvb/base:ubuntu_signed
ubuntu_signed:Pullingfromcrashvb/base
3b37166ec614:Alreadyexists
504facff238f:Alreadyexists
ebbcacd28e10:Alreadyexists
c7fb3351ecad:Alreadyexists
2e3debadcbf7:Alreadyexists
a5396a146776:Alreadyexists
6389d93ef5c7:Alreadyexists
e05442215521:Alreadyexists
f4ed07aa21a9:Alreadyexists
e41e7b47a71d:Alreadyexists
ae19c1f4b6b1:Alreadyexists
Digest:sha256:36e6e7cae412993ba19c0cf9a4583d1988e7668b5ce8e959f1915aabd0bb3bb2
Status:Downloadednewerimageforregistry:5000/crashvb/base:ubuntu_signed$dockerimages--format="{{.ID}}"registry:5000/crashvb/base:ubuntu
8ff76ab7ecbe$dockerimages--format="{{.ID}}"registry:5000/crashvb/base:ubuntu_signed
d9e31c5898feEnvironment VariablesVariableDefault ValueDescriptionDSV_CREDENTIALS_STORE~/.docker/config.jsonThe docker credentials store.DSV_DEFAULT_REGISTRYindex.docker.ioThe dockerhub registry API endpoint.DSV_DOCKERHUB_AUTHauth.docker.ioThe dockerhub authentication endpoint.DSV_GPG_DATASTORE~/.gnupgThe GnuPG home directory.DSV_GPG_LOG_ERRORSIf defined, errors from gnupg will be logged.DSV_KEYIDundefinedIdentifier of the signing key. For GnuPG this is the keyid. For PKI this is the path to PEM encoded private key.DSV_KEYPASS""The corresponding key passphrase.DSV_KEYTYPEGPGThe signature type. Either GPG or PKI.DSV_PKI_DATASTORE~/.dsv.pemThe PKI key store and trust store (concatenated PEM entities).DevelopmentSource Control