Unable to verify the container image using "strict" level on the trust policy

[madhav287]

level=error msg="authenticity validation failed. Failure reason: failed to validate the trusted certificate pub.pem in trust store codesigning-nonprod of type ca"

[yizha1]

@madhav287 Would you mind providing more information? Such as, Notation version, AKV plugin version, steps to reproduce the issue? Thanks.

[JeyJeyGao]

Hi @madhav287 , the trust store should store the root certificate of your signing certificate chain. Could you please ensure the pub.pem is a CA certificate?

[madhav287]

Hello all,

Can you please let me know your availability time to check on this issue?

Regards, Sethumadhav

On Wed, 29 May 2024, 12:39 pm Junjie Gao, @.***> wrote:

Hi @madhav287 https://github.com/madhav287 , the trust store should store the root certificate of your signing certificate chain. Could you please ensure the pub.pem is a CA certificate?

— Reply to this email directly, view it on GitHub https://github.com/Azure/notation-azure-kv/issues/184#issuecomment-2136691761, or unsubscribe https://github.com/notifications/unsubscribe-auth/AUFTR3EFUVLDYCPTTNJVFMDZEV5KNAVCNFSM6AAAAABIMHLJL2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZWGY4TCNZWGE . You are receiving this because you were mentioned.Message ID: @.***>

[JeyJeyGao]

Hello @madhav287, we can provide asynchronous support for GitHub issues. If you need 1:1 technical support, please create an Azure support ticket.

To investigate the issue further, we need more information. Could you provide the output for the following commands:

1. notation cert list
2. notation cert show --type ca --store codesigning-nonprod pub.pem

Thank you!

[madhav287]

++ @@.***

On Tue, 28 May 2024, 6:19 pm Yi Zha, @.***> wrote:

@madhav287 https://github.com/madhav287 Would you mind providing more information? Such as, Notation version, AKV plugin version, steps to reproduce the issue? Thanks.

— Reply to this email directly, view it on GitHub https://github.com/Azure/notation-azure-kv/issues/184#issuecomment-2135137312, or unsubscribe https://github.com/notifications/unsubscribe-auth/AUFTR3FL63TKIABFU2W7GRDZER4MTAVCNFSM6AAAAABIMHLJL2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZVGEZTOMZRGI . You are receiving this because you were mentioned.Message ID: @.***>

[madhav287]

Hello all,

our pipelines are running with notation version : v1.0.1 and AKV plugin version : v1.0.1,

We are passing root certificate on pub.pem while verifying the container image.

do let me know when and what time is suitable to connect on this issues.

Regards, Sethumadhav

---

From: madhav chinna @.> Sent: Wednesday, May 29, 2024 2:22 PM To: Azure/notation-azure-kv @.>; Kuntrpaku, Sethumadhav - Contractor {PEP} @.> Cc: Azure/notation-azure-kv @.>; Mention @.***> Subject: Re: [Azure/notation-azure-kv] Unable to verify the container image using "strict" level on the trust policy (Issue #184)

WARNING: Email originated outside of PepsiCo.

++ @@.**@.>

On Tue, 28 May 2024, 6:19 pm Yi Zha, @.**@.>> wrote:

@madhav287https://github.com/madhav287 Would you mind providing more information? Such as, Notation version, AKV plugin version, steps to reproduce the issue? Thanks.

— Reply to this email directly, view it on GitHubhttps://github.com/Azure/notation-azure-kv/issues/184#issuecomment-2135137312, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AUFTR3FL63TKIABFU2W7GRDZER4MTAVCNFSM6AAAAABIMHLJL2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZVGEZTOMZRGI. You are receiving this because you were mentioned.Message ID: @.***>

[madhav287]

Hello all,

Any updates on this.

or do you want me to schedule a call to discuss on this.

Thanks, Sethumadhav

---

From: Kuntrpaku, Sethumadhav - Contractor {PEP} @.> Sent: Wednesday, May 29, 2024 2:33 PM To: @. @.>; Azure/notation-azure-kv @.> Cc: Azure/notation-azure-kv @.>; Mention @.> Subject: Re: [Azure/notation-azure-kv] Unable to verify the container image using "strict" level on the trust policy (Issue #184)

Hello all,

our pipelines are running with notation version : v1.0.1 and AKV plugin version : v1.0.1,

We are passing root certificate on pub.pem while verifying the container image.

do let me know when and what time is suitable to connect on this issues.

Regards, Sethumadhav

---

From: madhav chinna @.> Sent: Wednesday, May 29, 2024 2:22 PM To: Azure/notation-azure-kv @.>; Kuntrpaku, Sethumadhav - Contractor {PEP} @.> Cc: Azure/notation-azure-kv @.>; Mention @.***> Subject: Re: [Azure/notation-azure-kv] Unable to verify the container image using "strict" level on the trust policy (Issue #184)

WARNING: Email originated outside of PepsiCo.

++ @@.**@.>

On Tue, 28 May 2024, 6:19 pm Yi Zha, @.**@.>> wrote:

@madhav287https://github.com/madhav287 Would you mind providing more information? Such as, Notation version, AKV plugin version, steps to reproduce the issue? Thanks.

— Reply to this email directly, view it on GitHubhttps://github.com/Azure/notation-azure-kv/issues/184#issuecomment-2135137312, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AUFTR3FL63TKIABFU2W7GRDZER4MTAVCNFSM6AAAAABIMHLJL2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZVGEZTOMZRGI. You are receiving this because you were mentioned.Message ID: @.***>

[yizha1]

@madhav287 It is recommended to create a support ticket for compliance and privacy purposes, as troubleshooting or logs may contain some information that is not supposed to be disclosed. See guidance https://learn.microsoft.com/azure/azure-portal/supportability/how-to-create-azure-support-request?

If you prefer to schedule a call for discussion, it is also OK, you can contact me via mail yizha1@microsoft.com, and we can discuss the schedule in the mail. Thanks.

[JeyJeyGao]

Closed this issue as it has been resolved in email threads.