Downloading Certified Container images from IBM Entitled Registry

Image signature verification

You can verify and ensure only IBM signed images are pulled in your environment by setting up image signature verification.

Setting up automatic signature enforcement

Perform the following steps to set up automatic signature verification:

1. Make the required changes in the /etc/containers/policy.json file. Set "default" : "type" as reject and add an entry for the ER repository in "transports".

   
   { 
                    "default": [ 
                        { 
                           "type":"reject"
                         } 
                      ], 
               "transports": 
                      { 
                        "docker": 
                          { 
                            "cp.icr.io/cp/ibm-b2bi/b2bi": [{ "type": "signedBy", "keyType": 
   "GPGKeys", "keyPath": "<b2bpublickey.gpg>"}]
                          } 
                       }
    }
   

   Note: To extract older unsigned images in your environment, change the policy.json to set "type":"insecureAcceptAnything" for ER repository, as shown below.

   
   { "default": [
                  {
                     "type":"insecureAcceptAnything"
                   }
                 ],
                 "transports":
                    {
                        "docker":
                            { 
                               "cp.icr.io/cp/ibm-b2bi/b2bi": [{ "type": "insecureAcceptAnything"}
                           ] 
                        } 
                    }
    }
   

2. Execute the following command to pull image from ER to your internal Docker repository.

   
   skopeo copy docker://cp.icr.io/cp/ibm-b2bi/b2bi:<tag> 
   docker://<local_repository>:<tag> --src-creds 
   iamapikey:key --dest-creds username:password
   
   For example, 
   skopeo copy docker://cp.icr.io/cp/ibm-b2bi/b2bi:6.1.0.3 
   docker://dockerrepo:5000/b2bi:6.1.0.3 --src-creds 
   iamapikey:key –dest-creds myuser:mypwd
   

Verifying signature manually