Search code examples
dockerkubernetesopenshiftpodman

How to check if a container image is signed in Openshift?

I have an openshift cluster. I have an image which I know is not signed. I want to check whether if an image is signed or not manually? Is there a command for this? I tried commands like these:

podman trust inspect <image_name>

skopeo inspect docker-daemon:myimage:latest

Is there a way to do this? Once I do this I want to check it in my cluster as well but this is second step? How can I do this for just one image?

Solution

  • You can configure openshift to require signatures from certain repositories, see e.g. the documentation or this article.

    There's no "check if an image is signed" feature in openshift; the above will cause openshift to reject unsigned images.

    You can use Skopeo to verify the signature on individual images as described in this article. Alternatively, you can []configure a trust policy in Podman](https://access.redhat.com/articles/3116561) and attempt to run an image.