Add containers/images signing policy

clement-dufour · Jun 3, 2024 · 9814071 · 9814071
1 parent 6615334
commit 9814071
Show file tree

Hide file tree

Showing 5 changed files with 38 additions and 0 deletions.
diff --git a/usr/etc/containers/policy.json b/usr/etc/containers/policy.json
@@ -0,0 +1,28 @@
+{
+    "default": [{"type": "reject"}],
+    "transports": {
+        "docker": {
+            "quay.io/toolbx-images": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPath": "/etc/pki/containers/quay.io-toolbx-images.pub",
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ],
+            "ghcr.io/clement-dufour": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPath": "/etc/pki/containers/ghcr.io-clement-dufour.pub",
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ]
+        },
+        "dir": {
+            "": [{"type": "insecureAcceptAnything"}]
+        }
+    }
+}
diff --git a/usr/etc/containers/registries.d/ghcr.io-clement-dufour.yaml b/usr/etc/containers/registries.d/ghcr.io-clement-dufour.yaml
@@ -0,0 +1,3 @@
+docker:
+  ghcr.io/clement-dufour:
+    use-sigstore-attachments: true
diff --git a/usr/etc/containers/registries.d/quay.io-toolbx-images.yaml b/usr/etc/containers/registries.d/quay.io-toolbx-images.yaml
@@ -0,0 +1,3 @@
+docker:
+  quay.io/toolbx-images:
+    use-sigstore-attachments: true
diff --git a/cosign.pub → ...pki/containers/ghcr.io-clement-dufour.pub b/cosign.pub → ...pki/containers/ghcr.io-clement-dufour.pub
diff --git a/usr/etc/pki/containers/quay.io-toolbx-images.pub b/usr/etc/pki/containers/quay.io-toolbx-images.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQr63Nsc66mA3oGMArrQPm8/AkuTO
+K+ZrK3WCWzx00LW5K1qu+BS3U4eyMmXaFKIsX69PEFZWzXKy9psum8wj9Q==
+-----END PUBLIC KEY-----