From e0de85ba453671711932a186b16f97a50ce5a647 Mon Sep 17 00:00:00 2001 From: Christian Manivong Date: Thu, 22 Oct 2026 18:48:49 +0200 Subject: [PATCH] docs: the attestations are on the platform image, not the index Checked against netork's first signed images (main-142912c): cosign verify on the tag succeeds, verify-attestation on it finds only the signature, because BuildKit pushes even one platform as an index with its provenance manifest. The CIS result and SBOM are on the linux/amd64 image. --- README.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 823bb58..54c2a44 100644 --- a/README.md +++ b/README.md @@ -66,11 +66,19 @@ pinned and checked against its release checksum (`bin/install-cosign.sh`). ## Verifying an image yourself ```bash -cosign verify --key cosign.pub --insecure-ignore-tlog registry.netork.io/netork/base-os@sha256:… +# The signature, on the tag or digest you pull (an index is signed with every image in it): +cosign verify --key cosign.pub --insecure-ignore-tlog registry.netork.io/netork/engine:latest-dev + +# The CIS result and the SBOM belong to each platform image, not to the index around it: +docker buildx imagetools inspect registry.netork.io/netork/engine:latest-dev # the linux/amd64 digest cosign verify-attestation --key cosign.pub --insecure-ignore-tlog \ - --type https://netork.io/attestations/cis/v1 registry.netork.io/netork/base-os@sha256:… + --type https://netork.io/attestations/cis/v1 registry.netork.io/netork/engine@sha256: +cosign verify-attestation --key cosign.pub --insecure-ignore-tlog \ + --type cyclonedx registry.netork.io/netork/engine@sha256: ``` +Even a single-platform image is pushed as an index: BuildKit adds its provenance manifest. + `cosign.pub` is the public half of the `COSIGN_PRIVATE_KEY_B64` organization secret. The private key comes base64 in one line: the runner masks a secret only where it appears whole.