Verifying images

Learn how to verify the signatures on the IBM® Netcool® Operations Insight® images.

Digital signatures provide a way for consumers of content to ensure that what they download is both authentic and has integrity. In other words, it originated from the expected source and is what it is expected to be. All images for IBM Netcool Operations Insight are signed.

Prerequisites

The following items are the prerequisites to run a signature verification:

Install the following tools on your workstation (these tools are usually installed on Linux® by using the package manager):
- GNU Privacy Guard v2
- OpenSSL
- Skopeo

The IBM Netcool Operations Insight public key must exist on the same workstation where you installed the tools. Copy the following text exactly as shown into a text editor and save it in a file named eventmanager-public.pub.asc:

Copy the following text exactly as shown into a text editor and save it in a file named eventmanager-public.pem.cer.

Copy the following text exactly as shown into a text editor and save it in a file named eventmanager-public.pem.chain.

Procedure

Install the certificate in the public key ring.

gpg2 --import eventmanager-public.pub.asc

Output resembles the following example:

gpg: key 58564C9D2A5048C2: "International Business Machines Corporation <psirt@us.ibm.com>" imported
gpg: Total number processed: 1
gpg:              imported: 1

Use Online Certificate Status Protocol to check the certificate validity.

openssl ocsp -no_nonce -issuer eventmanager-public.pem.chain -cert eventmanager-public.pem.cer -VAfile eventmanager-public.pem.chain -text -url http://ocsp.digicert.com -respout ocsptest

Output resembles the following example:

OCSP Request Data:
    Version: 1 (0x0)
    Requestor List:
        Certificate ID:
          Hash Algorithm: sha1
          Issuer Name Hash: 915DEAC5D1E15E49646B8A94E04E470958C9BB89
          Issuer Key Hash: 6837E0EBB63BF85F1186FBFE617B088865F44E42
          Serial Number: 020A747F6FE4A5DCB842E86B9F524A4F
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: 6837E0EBB63BF85F1186FBFE617B088865F44E42
    Produced At: Mar  9 08:37:03 2023 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: 915DEAC5D1E15E49646B8A94E04E470958C9BB89
      Issuer Key Hash: 6837E0EBB63BF85F1186FBFE617B088865F44E42
      Serial Number: 020A747F6FE4A5DCB842E86B9F524A4F
    Cert Status: good
    This Update: Mar  9 08:21:02 2023 GMT
    Next Update: Mar 16 07:36:02 2023 GMT

    Signature Algorithm: sha384WithRSAEncryption
         66:a5:83:30:48:52:e7:1a:93:19:5e:71:07:f5:74:d4:61:72:
         7e:a9:95:5a:05:38:c2:fb:e7:3d:14:2e:1c:d1:f4:cd:2c:a9:
         36:50:69:13:c0:80:6e:37:74:7f:de:8e:3d:6e:d1:34:b0:42:
         5e:8b:d2:b1:cd:a8:da:75:d9:3b:51:08:d0:ad:d3:d1:c2:9d:
         95:b5:a2:19:26:a2:df:86:68:85:af:02:8d:40:45:af:1d:77:
         85:a3:86:ce:e5:1a:f8:cd:cc:46:bc:0c:dd:04:49:63:6e:ec:
         cf:20:2d:da:de:7b:a2:4a:f9:01:68:60:cd:49:9b:7e:6a:32:
         6f:a3:6e:14:44:68:3b:15:cd:15:37:a0:01:86:06:82:25:e9:
         8f:ca:3d:9d:31:57:25:5f:d5:09:69:de:24:42:3e:c6:6c:6e:
         87:d5:19:cf:ed:0c:f7:3a:d7:8f:a0:aa:27:07:3a:d7:54:3e:
         8b:28:a3:d2:bc:9b:d0:be:00:c4:36:26:08:01:31:4c:4f:f4:
         b8:6d:48:dd:09:21:84:a7:41:5c:d5:f9:f1:0f:4c:d2:75:36:
         f1:2c:92:9c:d7:39:29:4f:9b:44:63:2f:71:eb:3c:85:76:a4:
         41:ca:1a:28:79:52:b5:c0:81:e5:f9:76:f4:62:9e:1f:13:57:
         1b:a3:c4:21:49:3d:12:f4:2c:35:0b:b0:4e:c0:a9:56:26:76:
         14:34:1b:b2:44:ca:2e:53:b9:70:d0:ca:e0:fe:b4:ab:0d:15:
         4f:e9:be:07:b5:41:94:49:3f:4d:f1:5a:ec:00:a5:6e:9d:54:
         60:0d:2d:ed:43:51:bb:01:83:19:84:03:ea:bc:13:27:4c:93:
         cb:29:d0:f4:7c:07:99:a1:94:9e:8e:9c:2a:0b:5d:eb:8a:38:
         c9:79:f6:b0:fe:c0:3e:8b:85:23:18:79:bc:af:48:2e:03:c9:
         a0:5a:c2:74:fd:84:65:ae:ad:d8:de:49:95:29:08:c3:c1:64:
         a7:97:06:b3:cf:a2:24:75:40:2e:f5:0d:8d:35:4f:0e:c2:62:
         40:c3:06:7f:27:6e:dd:e2:7f:16:08:02:f2:b1:48:f6:b9:e5:
         16:9a:b5:fd:95:4a:7f:89:e7:5a:14:03:63:e6:8a:86:f1:ba:
         d2:cb:b5:32:80:18:6a:aa:c9:14:23:57:38:ae:13:34:45:d2:
         9e:1b:6c:4d:4a:f4:19:12:26:8f:d4:38:9f:fd:4d:a0:48:ea:
         90:ad:ec:92:f1:91:9e:55:06:8c:e6:08:24:b2:a6:27:3a:ca:
         2f:f7:6d:4d:10:62:a7:af:14:3f:bf:72:7c:82:40:e5:d3:c3:
         2a:8c:10:4e:e5:bc:28:01
Response verify OK
PRD0010480key.pem.cer: good
	This Update: Mar  9 08:21:02 2023 GMT
	Next Update: Mar 16 07:36:02 2023 GMT

Verifying pull

Log in to your environment.
Create or update an /etc/containers/policy.json file or ~/policy.json file. If you have more than one public key from another platform or if you have more than one after the certificate renewal, you can concatenate both GPG public keys into one file. Then, use the concatenated file in place of the <public key> variable that is shown in the following example.
A policy might be specified so that tools such as Skopeo and Podman are prevented from downloading the images that are not signed and verified. This policy is the approved method for verifying images on bastion hosts during air-gapped deployments.
```
cat /etc/containers/policy.json
{
    "default": [
        {
            "type": "reject"
        }
    ],
    "transports":
        {
            "docker":
                {
                    "": [{ "type": "signedBy", "keyType": "GPGKeys", "keyPath": "<public key>"}]
                }
        }
}
```
Where <keyPath> is the path to the Netcool Operations Insight public certificate. An attempt to download an unsigned or unauthenticated image results in failure.

Validate by using the skopeo copy command to a local temp directory.

skopeo copy docker://icr.io/<repo/image:tag> dir:<imagedir> --src-creds cp:<IBM entitlement key>

Validate by using the skopeo copy command to a local temp directory with the --policy option.
```
skopeo copy --policy ~/policy.json docker://icr.io/<repo/image:tag> dir:<imagedir>
```

Validate during pull with the podman pull command.

podman pull --signature-policy ~/policy.json icr.io/<repo/image:tag>

Verifying a local image

Copy the public key to the file system, such as eventmanager-public.pub.asc.
Import the public key into the GPG keystore:
```
gpg --import ./eventmanager-public.pub.asc
```

Find the fingerprint for the imported key:

gpg -k
or
export FINGERPRINT=$(gpg --fingerprint --with-colons | grep fpr | tr -d 'fpr:')

Copy the image locally:

skopeo copy docker://icr.io/<repo/image:tag>  dir:<imagedir> --src-creds cp:<IBM entitlement key>

Use the skopeo standalone-verify command to verify the image signature.

skopeo standalone-verify <imagedir>/manifest.json icr.io/<repo:tag> <gpgkeyfingerprint> <imagedir>/signature

Verifying the image results in an output that is similar to the following example:

Signature verified, digest sha256:62f787b94e5faddb79f96c84ac0877aaf28fb325bfc3601b9c0934d4c107ba94