Sign and publish the bootc operating system image by using Sigstore

Sign your bootc operating system image with a Sigstore key pair and publish it to your OCI registry.

About this task

To sign the bootc operating system image by using Sigstore, complete the following steps:

Procedure

  1. Generate a Sigstore key pair named signingkey.pub and signingkey.private: 
    skopeo generate-sigstore-key --output-prefix signingkey
  2. Configure container tools such as Podman and Skopeo to upload Sigstore signatures together with your signed image to your OCI registry: 
    sudo tee "/etc/containers/registries.d/${OCI_REGISTRY}.yaml" > /dev/null <<EOF
docker:
    ${OCI_REGISTRY}:
        use-sigstore-attachments: true
EOF
  3. Log in to your OCI registry by running the following command: 
    sudo podman login ${OCI_REGISTRY}
  4. Sign and publish the operating system image by running the following command: 
    sudo podman push \
    --sign-by-sigstore-private-key ./signingkey.private \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}