From a3567ff6a0c6c452a0ee97abbd723fadc02cc946 Mon Sep 17 00:00:00 2001 From: yeasy Date: Thu, 21 May 2026 19:14:33 -0700 Subject: [PATCH] docs: use digest-based cosign signing --- 18_security/18.6_image_security.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/18_security/18.6_image_security.md b/18_security/18.6_image_security.md index 46123e4..06217e1 100644 --- a/18_security/18.6_image_security.md +++ b/18_security/18.6_image_security.md @@ -240,8 +240,9 @@ cosign generate-key-pair **签名镜像：** ```bash -# 使用私钥签名（推送到仓库前） -cosign sign --key cosign.key myregistry.com/myapp:v1.0.0 +# 先推送镜像，再使用不可变 digest 签名 +IMAGE_DIGEST="myregistry.com/myapp@sha256:" +cosign sign --key cosign.key "$IMAGE_DIGEST" # 系统会提示输入私钥密码 ``` @@ -249,7 +250,7 @@ cosign sign --key cosign.key myregistry.com/myapp:v1.0.0 ```bash # 使用公钥验证 -cosign verify --key cosign.pub myregistry.com/myapp:v1.0.0 +cosign verify --key cosign.pub "$IMAGE_DIGEST" # 输出结果示例 # Verification successful! @@ -266,10 +267,10 @@ cosign verify --key cosign.pub myregistry.com/myapp:v1.0.0 ```bash # 在 GitHub Actions 等 CI 中无需存储密钥 -cosign sign --yes myregistry.com/myapp:v1.0.0 +cosign sign --yes "$IMAGE_DIGEST" # 验证时自动使用 OIDC 令牌验证身份 -cosign verify myregistry.com/myapp:v1.0.0 \ +cosign verify "$IMAGE_DIGEST" \ --certificate-identity https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main \ --certificate-oidc-issuer https://token.actions.githubusercontent.com ```