releng

#10624 Sign container images
Opened by demiobenour. Modified

Open
Close Issue

  • Describe the issue

    Fedora’s container images should be signed by official Fedora project keys, just like Red Hat’s are.

  • When do you need this? (YYYY/MM/DD)

    2022/02/21 but sooner would be amazing

  • When is this no longer needed or useful? (YYYY/MM/DD)

    N/A — sooner is better than later, but later is better than never

  • If we cannot complete your request, what is the impact?

    Qubes OS will need to generate and sign its own container images, since it cannot verify the authenticity of ones shipped by Fedora.

Metadata Update from @zlopez:
- Issue tagged with: meeting

Any ideas about how to approach this? @cverna @otaylor

Metadata Update from @amedvede:
- Issue tagged with: sprint-2

@demiobenour Do it still needed?

Metadata Update from @amedvede:
- Issue assigned to amedvede

@amedvede if it hasn't been implemented, it's still needed.

Related to this, travier requested a way to use cosign to sign containers. Those wouldn't be GPG signatures, though.

Metadata Update from @jnsamyak:
- Issue tagged with: medium-gain, medium-trouble

Investigating it
Edited by amedvede

Issue tagged with: sprint-3

Issue tagged with: sprint-4

Metadata Update from @jnsamyak:
- Issue untagged with: sprint-2, sprint-3

Hey all, lets go deep into this problem and hopefully will fix it soon enough

1) We making 3 container images fedora-base, fedora-minimal, fedora-toolbox and sync those images to quay.io, we build them using pungi. And here I see at least in description that it uses kickstarts to build container image for docker hub. So question is what exactly images you would to be signed?
2)As far as I know we don't support to update dockerhub, and it should be documented somewhere. Can you suggest the place where? Also fix if I'm mistaking.
3)Can you verify that image is still not signed? because pungi config has variable sigkey so it might be signed indeed. Would like to mention that I'm not an expert in signing and just trying to learn how this process works so fix me where I'm wrong.
4)If it still needed I believe it should be done on on pungi side
Metadata

medium-gain medium-trouble meeting sprint-5

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.