76 lines
3.4 KiB
Groff
76 lines
3.4 KiB
Groff
.nh
|
|
.TH podman-image-sign 1
|
|
.SH NAME
|
|
podman-image-sign \- Create a signature for an image
|
|
|
|
.SH SYNOPSIS
|
|
\fBpodman image sign\fP [\fIoptions\fP] \fIimage\fP [\fIimage\fP ...]
|
|
|
|
.SH DESCRIPTION
|
|
\fBpodman image sign\fP creates a local signature for one or more local images that have
|
|
been pulled from a registry. The signature is written to a directory
|
|
derived from the registry configuration files in \fB$HOME/.config/containers/registries.d\fR if it exists,
|
|
otherwise \fB/etc/containers/registries.d\fR (unless overridden at compile-time), see \fBcontainers-registries.d(5)\fP for more information.
|
|
By default, the signature is written into \fB/var/lib/containers/sigstore\fR for root and \fB$HOME/.local/share/containers/sigstore\fR for non-root users
|
|
|
|
.SH OPTIONS
|
|
.SS \fB--all\fP, \fB-a\fP
|
|
Sign all the manifests of the multi-architecture image (default false).
|
|
|
|
.SS \fB--authfile\fP=\fIpath\fP
|
|
Path of the authentication file. Default is \fB${XDG_RUNTIME_DIR}/containers/auth.json\fR on Linux, and \fB$HOME/.config/containers/auth.json\fR on Windows/macOS.
|
|
The file is created by \fBpodman login\fP\&. If the authorization state is not found there, \fB$HOME/.docker/config.json\fR is checked, which is set using \fBdocker login\fP\&.
|
|
|
|
.PP
|
|
Note: There is also the option to override the default path of the authentication file by setting the \fBREGISTRY_AUTH_FILE\fR environment variable. This can be done with \fBexport REGISTRY_AUTH_FILE=\fIpath\fP\fP\&.
|
|
|
|
.SS \fB--cert-dir\fP=\fIpath\fP
|
|
Use certificates at \fIpath\fP (*\&.crt, *\&.cert, *\&.key) to connect to the registry. (Default: /etc/containers/certs.d)
|
|
For details, see \fBcontainers-certs.d(5)\fP\&.
|
|
(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines)
|
|
|
|
.SS \fB--directory\fP, \fB-d\fP=\fIdir\fP
|
|
Store the signatures in the specified directory. Default: /var/lib/containers/sigstore
|
|
|
|
.SS \fB--help\fP, \fB-h\fP
|
|
Print usage statement.
|
|
|
|
.SS \fB--sign-by\fP=\fIidentity\fP
|
|
Override the default identity of the signature.
|
|
|
|
.SH EXAMPLES
|
|
Sign the busybox image with the identity of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/.
|
|
|
|
.EX
|
|
$ sudo podman image sign --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar
|
|
|
|
$ sudo podman image sign --authfile=/tmp/foobar.json --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar
|
|
.EE
|
|
|
|
.SH RELATED CONFIGURATION
|
|
The write (and read) location for signatures is defined in YAML-based
|
|
configuration files in /etc/containers/registries.d/ for root,
|
|
or $HOME/.config/containers/registries.d for non-root users. When signing
|
|
an image, Podman uses those configuration files to determine
|
|
where to write the signature based on the name of the originating
|
|
registry or a default storage value unless overridden with the --directory
|
|
option. For example, consider the following configuration file.
|
|
|
|
.EX
|
|
docker:
|
|
privateregistry.example.com:
|
|
sigstore: file:///var/lib/containers/sigstore
|
|
.EE
|
|
|
|
.PP
|
|
When signing an image preceded with the registry name 'privateregistry.example.com',
|
|
the signature is written into sub-directories of
|
|
/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means
|
|
the signature is 'read' from that same location on a pull-related function.
|
|
|
|
.SH SEE ALSO
|
|
\fBcontainers-certs.d(5)\fP, \fBcontainers-registries.d(5)\fP
|
|
|
|
.SH HISTORY
|
|
November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com)
|