Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify verify and sif commands are for local images, from sylabs210 #244

Merged
merged 1 commit into from
Mar 7, 2024
Merged

Clarify verify and sif commands are for local images, from sylabs210 #244

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions signNverify.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ public key or certificate. By default, {Project} uses PGP keys to sign and
verify containers. Signing and verifying containers with X.509 key material
/ certificates is also supported.

PGP Public key material (used for verification) can be distributed manually, or
PGP Public keys for verification can be distributed manually, or
can be uploaded to and automatically retrieved from a remote keyserver.

As well as indicating a container has not been modified, a valid signature may
Expand All @@ -42,11 +42,10 @@ for more information).
Verifying containers from remote sources
****************************************

The ``verify`` command will allow you to verify that a SIF container image has
The ``verify`` command will check that a SIF container image has
been signed using a PGP key or certificate. This ensures that the container
image on your disk is a bit-for-bit reproduction of the original image.


.. code::

$ {command} verify alpine_latest.sif
Expand All @@ -68,6 +67,11 @@ container.
This feature is available with SIF images like those you can pull from container
libraries or OCI registries via ``oras://``.

.. note::

``{command} verify`` will only run against a local SIF file. You must
``pull`` an image to a local disk before you can verify it.

.. _sign_your_own_containers:

***************************
Expand Down Expand Up @@ -293,6 +297,11 @@ of objects. Each object has an ``ID``, and belongs to a ``GROUP``.
4 |1 |NONE |45056-2781184 |FS (Squashfs/*System/amd64)
5 |NONE |1 (G) |2781184-2782981 |Signature (SHA-256)

.. note::

The ``{command} sif`` commands will only run against a local SIF file. You
must ``pull`` an image to a local disk before you can examine it.

I can choose to sign and verify a specific object with the ``--sif-id``
option to ``sign`` and ``verify``.

Expand Down
Loading