Validating the Verify Bridge on Docker Image signature

Edit online

The icr.io/isv-saas/verify-bridge:latest image on IBM® Container Registry is signed and when the image is pulled down to your machine this signature can be validated by using Skopeo or Podman.

Before you begin

You need the public key.

About this task

The container runtime that Red Hat® OpenShift®, Skopeo, and Podman use are a policy.json file that describes the signature validation policy. When the policy is created and applied to the container tools (Red Hat OpenShift, Skopeo, or Podman), the policy enforces image integrity by validating the signature. It can also validate other parts of the simple signing payload.

Procedure

Log in to the target system.
Create or update an /etc/containers/policy.json or a file such as ~/policy.json.
See the Red Hat OpenShift documentation on image policy: podman-image-trust. If you have more than one public key from an old and a new platform or after cert renewal, you can concatenate both gpg public keys and use that file at <public key>.
For example,
```
{
    "default": [
        {
            "type":"reject"
        }
    ],
    "transports":
        {
            "docker":
                {
                    "": [{ "type": "signedBy", "keyType": "GPGKeys", "keyPath": "<path to public keyfile>"}]
                }
        }
}
```
Specify the method to validate Verify Bridge on Docker Image Signature by using one of the following commands.
- To validate the signature by using Skopeo to copy to a local temp directory, use the following command.
```
skopeo copy --policy ~/policy.json docker://icr.io/isv-saas/verify-bridge:latest dir:./temp
```
- To validate the signature by using Skopeo to copy to a local temp directory with the --policy option, use the following command.
```
skopeo copy --policy ~/policy.json docker://icr.io/isv-saas/verify-bridge:latest dir:./temp
```
- To validate the signature during a pull by using Podman, use the following command.
```
podman pull --signature-policy ~/policy.json icr.io/isv-saas/verify-bridge:latest
```