Optional: Signing and publishing the operating system disk image to an Open Container Initiative registry

Sign your disk image with the same Sigstore key you used for the bootc image and publish it to your OCI registry as an OCI artifact.

About this task

Sign and publish your disk image to your Open Container Initiative (OCI) registry. You can compress and publish the disk image as an OCI artifact to the same OCI registry as your bootc images. This approach provides unified hosting and distribution of bootc and disk images. To publish your ISO disk image to a repository named after your bootc image with /diskimage-iso appended, complete the following steps:

Prerequisites

  • You created a private key by using Sigstore. See Signing and publishing the _bootc operating system image by using Sigstore_ in the Additional resources section.

Optional: Signing and publishing the operating system disk image to an OCI registry

Sign and publish your disk image to your OCI registry. Complete the following steps:

Procedure

  1. Change the owner of the directory where the ISO disk image is located from root to your current user. Run the following command: 
    sudo chown -R $(whoami):$(whoami) "${PWD}/output"
  2. Define the OCI_DISK_IMAGE_REPO environmental variable to be the same repository as your bootc image with /diskimage-iso appended. Run the following command: 
    OCI_DISK_IMAGE_REPO=${OCI_IMAGE_REPO}/diskimage-iso
  3. Create a manifest list by running the following command: 
    sudo podman manifest create \
    ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}
  4. Add the ISO disk image to the manifest list as an OCI artifact by running the following command: 
    sudo podman manifest add \
    --artifact --artifact-type application/vnd.diskimage.iso \
    --arch=amd64 --os=linux \
    ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG} \
    "${PWD}/output/bootiso/install.iso"
  5. Sign the manifest list with your private Sigstore key and push the image to the registry. Run the following command: 
    sudo podman manifest push --all \
     --sign-by-sigstore-private-key ./signingkey.private \
    ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG} \
    docker://${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}

    For a full list of available repositories, search for "Red Hat Edge Manager" in the Browse packages for all my products dropdown menu on the Red Hat package browser.