{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/91356529","pull_request_review_id":11865816,"id":91356529,"diff_hunk":"@@ -0,0 +1,129 @@\n+# Image Signing\n+\n+## Abstract\n+\n+This proposal describes the process of verifying the signatures of Docker Images and\n+enforce enforce policy that will prevent the image from running in the cluster if the\n+image signature is not trusted.\n+\n+## Use-cases\n+\n+* As an admin, I want to be able to add trusted GPG public keys to my cluster and determine through policy\n+  the keys that are required to run certain images\n+* As an user, I want to be able to see what images are signed and if the signature is trusted\n+\n+## Overview\n+\n+### Signing Images with Skopeo\n+\n+The current signing mechanism for Docker image is to use the\n+[Skopeo](https://github.com/projectatomic/skopeo/blob/master/docs/skopeo.1.md) tool which\n+will sign the Docker image locally, using the GPG key and attach the signature to the\n+Docker Image. The Docker image is then pushed to a Docker Registry with enabled signature","path":"docs/proposals/image-signing.md","position":22,"original_position":22,"commit_id":"46f30d97b252fe9ff2ae008872099be1250e770a","original_commit_id":"46f30d97b252fe9ff2ae008872099be1250e770a","user":{"login":"aweiteka","id":1764461,"avatar_url":"https://avatars.githubusercontent.com/u/1764461?v=3","gravatar_id":"","url":"https://api.github.com/users/aweiteka","html_url":"https://github.com/aweiteka","followers_url":"https://api.github.com/users/aweiteka/followers","following_url":"https://api.github.com/users/aweiteka/following{/other_user}","gists_url":"https://api.github.com/users/aweiteka/gists{/gist_id}","starred_url":"https://api.github.com/users/aweiteka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aweiteka/subscriptions","organizations_url":"https://api.github.com/users/aweiteka/orgs","repos_url":"https://api.github.com/users/aweiteka/repos","events_url":"https://api.github.com/users/aweiteka/events{/privacy}","received_events_url":"https://api.github.com/users/aweiteka/received_events","type":"User","site_admin":false},"body":"* the signature can be either stored locally as a file \"blob\" (\"docker\" transport type) or posted to the openshift API (\"atomic\" transport type). See [signature API](https://docs.openshift.org/latest/rest_api/openshift_v1.html#create-a-imagesignature).\r\n* The signature is a detached object that can be stored and served independent of the associated image.\r\n","created_at":"2016-12-07T18:33:39Z","updated_at":"2016-12-07T19:04:13Z","html_url":"https://github.com/openshift/origin/pull/12170#discussion_r91356529","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/12170","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/91356529"},"html":{"href":"https://github.com/openshift/origin/pull/12170#discussion_r91356529"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/12170"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/12170","id":96907941,"html_url":"https://github.com/openshift/origin/pull/12170","diff_url":"https://github.com/openshift/origin/pull/12170.diff","patch_url":"https://github.com/openshift/origin/pull/12170.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/12170","number":12170,"state":"open","locked":false,"title":"Proposal: Use ImagePolicyWebhook to verify image signatures","user":{"login":"mfojtik","id":44136,"avatar_url":"https://avatars.githubusercontent.com/u/44136?v=3","gravatar_id":"","url":"https://api.github.com/users/mfojtik","html_url":"https://github.com/mfojtik","followers_url":"https://api.github.com/users/mfojtik/followers","following_url":"https://api.github.com/users/mfojtik/following{/other_user}","gists_url":"https://api.github.com/users/mfojtik/gists{/gist_id}","starred_url":"https://api.github.com/users/mfojtik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfojtik/subscriptions","organizations_url":"https://api.github.com/users/mfojtik/orgs","repos_url":"https://api.github.com/users/mfojtik/repos","events_url":"https://api.github.com/users/mfojtik/events{/privacy}","received_events_url":"https://api.github.com/users/mfojtik/received_events","type":"User","site_admin":false},"body":"This proposal describes the process of verifying the signatures of Docker Images and\r\nenforce enforce policy that will prevent the image from running in the cluster if the\r\nimage signature is not trusted.\r\n\r\nPOC: https://github.com/openshift/origin/compare/master...mfojtik:image-signing?expand=1","created_at":"2016-12-07T11:44:22Z","updated_at":"2016-12-07T19:04:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7ebec55e961ffd3cee16be3198194a7aa44152f0","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/12170/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/12170/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/12170/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/46f30d97b252fe9ff2ae008872099be1250e770a","head":{"label":"mfojtik:image-signing-proposal","ref":"image-signing-proposal","sha":"46f30d97b252fe9ff2ae008872099be1250e770a","user":{"login":"mfojtik","id":44136,"avatar_url":"https://avatars.githubusercontent.com/u/44136?v=3","gravatar_id":"","url":"https://api.github.com/users/mfojtik","html_url":"https://github.com/mfojtik","followers_url":"https://api.github.com/users/mfojtik/followers","following_url":"https://api.github.com/users/mfojtik/following{/other_user}","gists_url":"https://api.github.com/users/mfojtik/gists{/gist_id}","starred_url":"https://api.github.com/users/mfojtik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfojtik/subscriptions","organizations_url":"https://api.github.com/users/mfojtik/orgs","repos_url":"https://api.github.com/users/mfojtik/repos","events_url":"https://api.github.com/users/mfojtik/events{/privacy}","received_events_url":"https://api.github.com/users/mfojtik/received_events","type":"User","site_admin":false},"repo":{"id":22954249,"name":"origin","full_name":"mfojtik/origin","owner":{"login":"mfojtik","id":44136,"avatar_url":"https://avatars.githubusercontent.com/u/44136?v=3","gravatar_id":"","url":"https://api.github.com/users/mfojtik","html_url":"https://github.com/mfojtik","followers_url":"https://api.github.com/users/mfojtik/followers","following_url":"https://api.github.com/users/mfojtik/following{/other_user}","gists_url":"https://api.github.com/users/mfojtik/gists{/gist_id}","starred_url":"https://api.github.com/users/mfojtik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfojtik/subscriptions","organizations_url":"https://api.github.com/users/mfojtik/orgs","repos_url":"https://api.github.com/users/mfojtik/repos","events_url":"https://api.github.com/users/mfojtik/events{/privacy}","received_events_url":"https://api.github.com/users/mfojtik/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mfojtik/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/mfojtik/origin","forks_url":"https://api.github.com/repos/mfojtik/origin/forks","keys_url":"https://api.github.com/repos/mfojtik/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mfojtik/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mfojtik/origin/teams","hooks_url":"https://api.github.com/repos/mfojtik/origin/hooks","issue_events_url":"https://api.github.com/repos/mfojtik/origin/issues/events{/number}","events_url":"https://api.github.com/repos/mfojtik/origin/events","assignees_url":"https://api.github.com/repos/mfojtik/origin/assignees{/user}","branches_url":"https://api.github.com/repos/mfojtik/origin/branches{/branch}","tags_url":"https://api.github.com/repos/mfojtik/origin/tags","blobs_url":"https://api.github.com/repos/mfojtik/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mfojtik/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mfojtik/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/mfojtik/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mfojtik/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/mfojtik/origin/languages","stargazers_url":"https://api.github.com/repos/mfojtik/origin/stargazers","contributors_url":"https://api.github.com/repos/mfojtik/origin/contributors","subscribers_url":"https://api.github.com/repos/mfojtik/origin/subscribers","subscription_url":"https://api.github.com/repos/mfojtik/origin/subscription","commits_url":"https://api.github.com/repos/mfojtik/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/mfojtik/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/mfojtik/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/mfojtik/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/mfojtik/origin/contents/{+path}","compare_url":"https://api.github.com/repos/mfojtik/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mfojtik/origin/merges","archive_url":"https://api.github.com/repos/mfojtik/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mfojtik/origin/downloads","issues_url":"https://api.github.com/repos/mfojtik/origin/issues{/number}","pulls_url":"https://api.github.com/repos/mfojtik/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/mfojtik/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/mfojtik/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mfojtik/origin/labels{/name}","releases_url":"https://api.github.com/repos/mfojtik/origin/releases{/id}","deployments_url":"https://api.github.com/repos/mfojtik/origin/deployments","created_at":"2014-08-14T13:11:47Z","updated_at":"2016-01-12T09:38:06Z","pushed_at":"2016-12-07T17:43:41Z","git_url":"git://github.com/mfojtik/origin.git","ssh_url":"git@github.com:mfojtik/origin.git","clone_url":"https://github.com/mfojtik/origin.git","svn_url":"https://github.com/mfojtik/origin","homepage":"https://openshift.github.io","size":419804,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"5c6a1d473c6a5a1a15ede004f0fb86aeae6d339b","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"Enterprise Kubernetes for Developers","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","deployments_url":"https://api.github.com/repos/openshift/origin/deployments","created_at":"2014-07-30T20:04:05Z","updated_at":"2016-12-07T14:41:47Z","pushed_at":"2016-12-07T18:57:41Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":674303,"stargazers_count":2114,"watchers_count":2114,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1405,"mirror_url":null,"open_issues_count":1170,"forks":1405,"open_issues":1170,"watchers":2114,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/12170"},"html":{"href":"https://github.com/openshift/origin/pull/12170"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/12170"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/12170/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/12170/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/12170/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/46f30d97b252fe9ff2ae008872099be1250e770a"}}}}
{"actor":{"display_login":"aweiteka"}}