search

notaryproject / notation

A CLI tool to sign and verify artifacts
https://notaryproject.dev/
Apache License 2.0
306 stars 84 forks source link

Skopeo Copy notation specific signatures #882

Closed omkhard closed 4 months ago

omkhard commented 5 months ago

Is your feature request related to a problem?

Hi , We are doing container image signing/verifying , we needed to do it using X509 certificates so notation was best suited for it, If i am trying to detach signature using 'skopeo'.

It gives an error , I don't know if skopeo is not compliant or notation's signature type is different.

root@okhardubuntu:/home/ubuntu# skopeo inspect docker://<ARTIFACT_REPO_URL>debian15@sha256:c12a3cced3b1812feb9f1675a6087ed238e4a0a1ef79c24fe64a4cc3794b3471 FATA[0000] unsupported image-specific operation on artifact with type "application/vnd.cncf.notary.signature"

What solution do you propose?

If the signature's 'mediaType' could be standard and attaching 'notation' in an other attribute (attestors , or signatureType kind of).

Any additional context?

No response

sajayantony commented 5 months ago

Has skopeo made the change to understand refererers? It would be good to have an issue on skopeo side on generic referrers support which is a part of the OCI spec.

omkhard commented 4 months ago

sure , I gotta check with skopeo side , Thanks for replying