ehlxr/docker_practice
1
0
Fork 0
mirror of https://github.com/yeasy/docker_practice.git synced 2026-08-10 16:37:34 +00:00
Code Issues Projects Releases Wiki Activity

docs: use digest-based cosign signing

Browse Source
This commit is contained in:
yeasy
2026-05-21 19:14:33 -07:00
parent 9ef842ebb3
commit a3567ff6a0
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
18_security/18.6_image_security.md
+6 -5
View File
@@ -240,8 +240,9 @@ cosign generate-key-pair
**签名镜像：** **签名镜像：**
```bash ```bash
# 使用私钥签名（推送到仓库前） # 先推送镜像，再使用不可变 digest 签名
cosign sign --key cosign.key myregistry.com/myapp:v1.0.0 IMAGE_DIGEST="myregistry.com/myapp@sha256:<digest>"
cosign sign --key cosign.key "$IMAGE_DIGEST"
# 系统会提示输入私钥密码 # 系统会提示输入私钥密码
``` ```
@@ -249,7 +250,7 @@ cosign sign --key cosign.key myregistry.com/myapp:v1.0.0
```bash ```bash
# 使用公钥验证 # 使用公钥验证
cosign verify --key cosign.pub myregistry.com/myapp:v1.0.0 cosign verify --key cosign.pub "$IMAGE_DIGEST"
# 输出结果示例 # 输出结果示例
# Verification successful! # Verification successful!
@@ -266,10 +267,10 @@ cosign verify --key cosign.pub myregistry.com/myapp:v1.0.0
```bash ```bash
# 在 GitHub Actions 等 CI 中无需存储密钥 # 在 GitHub Actions 等 CI 中无需存储密钥
cosign sign --yes myregistry.com/myapp:v1.0.0 cosign sign --yes "$IMAGE_DIGEST"
# 验证时自动使用 OIDC 令牌验证身份 # 验证时自动使用 OIDC 令牌验证身份
cosign verify myregistry.com/myapp:v1.0.0 \ cosign verify "$IMAGE_DIGEST" \
--certificate-identity https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main \ --certificate-identity https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main \
--certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-oidc-issuer https://token.actions.githubusercontent.com
``` ```