Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

doc: Add a note to state the limitations in CMK-encrypted registry #35

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
+9 −0
Open

doc: Add a note to state the limitations in CMK-encrypted registry #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
aecbb17
Update container-registry-tutorial-sign-build-push.md
FeynmanZhou Dec 9, 2024
b31f039
Update container-registry-tutorial-sign-build-push.md
FeynmanZhou Dec 9, 2024
7e75ba3
Update container-registry-manage-artifact.md
FeynmanZhou Dec 9, 2024
84d6dde
Update container-registry-tutorial-sign-trusted-ca.md
FeynmanZhou Dec 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions articles/container-registry/container-registry-manage-artifact.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,9 @@ Storing individual (subject) OCI Artifacts are covered in [Push and pull OCI art

To store a graph of artifacts, a reference to a `subject` artifact is defined using the [OCI image manifest][oci-image-manifest], which is part of the [prerelease OCI 1.1 Distribution specification][oci-1_1-spec].

> [!NOTE]
> ORAS uses the OCI Referrers API](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers) to store the attached referrer artifacts in the registry by default. The OCI Referrers API is supported by most of the ACR features except the CMK-encrypted registry. ORAS will fall back to use [OCI Referrers Tag Schema](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#referrers-tag-schema) to store the attached referrers in the CMK-encrypted registry.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Always used versioned tag or commit for the link instead of the main branch.


### Push a container image

To associate a graph of artifacts with a container image using the Azure CLI:
Expand Down
3 changes: 3 additions & 0 deletions articles/container-registry/container-registry-tutorial-sign-build-push.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,9 @@ The following steps show how to create a self-signed certificate for testing pur
| Workload identity credential | `workloadid` |
| Managed identity credential | `managedid` |
| Azure CLI credential | `azurecli` |

> [!NOTE]
> Notation uses [OCI Referrers Tag Schema](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#referrers-tag-schema) to store the signature in ACR by default. You can also enable [OCI Referrers API](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers) by using the flag `--force-referrers-tag false` if needed. The OCI Referrers API is supported by most of the ACR features except the CMK-encrypted registry.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which version of notation?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@FeynmanZhou Can you respond to the comment above?

@MicrosoftDocs/public-repo-pr-review-team


5. View the graph of signed images and associated signatures.

Expand Down
3 changes: 3 additions & 0 deletions articles/container-registry/container-registry-tutorial-sign-trusted-ca.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,6 +315,9 @@ To learn more about assigning policy to a principal, see [Assign Access Policy](
└── sha256:d7258166ca820f5ab7190247663464f2dcb149df4d1b6c4943dcaac59157de8e
```

> [!NOTE]
> Notation uses [OCI Referrers Tag Schema](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#referrers-tag-schema) to store the signature in ACR by default. You can also enable [OCI Referrers API](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers) by using the flag `--force-referrers-tag false` if needed. The OCI Referrers API is supported by most of the ACR features except the CMK-encrypted registry.

## Verify a container image with Notation CLI

1. Add the root certificate to a named trust store for signature verification. If you do not have the root certificate, you can obtain it from your CA. The following example adds the root certificate `$ROOT_CERT` to the `$STORE_NAME` trust store.
Expand Down