{"action":"created","issue":{"url":"https://api.github.com/repos/containers/skopeo/issues/560","repository_url":"https://api.github.com/repos/containers/skopeo","labels_url":"https://api.github.com/repos/containers/skopeo/issues/560/labels{/name}","comments_url":"https://api.github.com/repos/containers/skopeo/issues/560/comments","events_url":"https://api.github.com/repos/containers/skopeo/issues/560/events","html_url":"https://github.com/containers/skopeo/issues/560","id":369777108,"node_id":"MDU6SXNzdWUzNjk3NzcxMDg=","number":560,"title":"copy: add null transport format to support signature verification","user":{"login":"alonbl","id":1263789,"node_id":"MDQ6VXNlcjEyNjM3ODk=","avatar_url":"https://avatars1.githubusercontent.com/u/1263789?v=4","gravatar_id":"","url":"https://api.github.com/users/alonbl","html_url":"https://github.com/alonbl","followers_url":"https://api.github.com/users/alonbl/followers","following_url":"https://api.github.com/users/alonbl/following{/other_user}","gists_url":"https://api.github.com/users/alonbl/gists{/gist_id}","starred_url":"https://api.github.com/users/alonbl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alonbl/subscriptions","organizations_url":"https://api.github.com/users/alonbl/orgs","repos_url":"https://api.github.com/users/alonbl/repos","events_url":"https://api.github.com/users/alonbl/events{/privacy}","received_events_url":"https://api.github.com/users/alonbl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-10-13T07:35:21Z","updated_at":"2018-10-15T18:03:27Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nMaybe I am missing something, but there is no way to perform verify only of an image signature with the policy configuration. The only option I found is to use the copy the image to other image.\r\n\r\nIf that's true, it would be great if you add null transport format to allow something like:\r\n\r\n```\r\n$ skopeo copy docker://registry1.com/image:tag null:\r\nWriting manifest to image destination\r\nStoring signatures\r\n```\r\n\r\nThis will execute the cycle of verifying the source while not download/uploading the entire content, the null transport should also allow writing signatures (to null...) to avoid explicit `--remove-signatures`.\r\n\r\nAny better option to verify only?\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/containers/skopeo/issues/comments/429954606","html_url":"https://github.com/containers/skopeo/issues/560#issuecomment-429954606","issue_url":"https://api.github.com/repos/containers/skopeo/issues/560","id":429954606,"node_id":"MDEyOklzc3VlQ29tbWVudDQyOTk1NDYwNg==","user":{"login":"mtrmac","id":7052838,"node_id":"MDQ6VXNlcjcwNTI4Mzg=","avatar_url":"https://avatars2.githubusercontent.com/u/7052838?v=4","gravatar_id":"","url":"https://api.github.com/users/mtrmac","html_url":"https://github.com/mtrmac","followers_url":"https://api.github.com/users/mtrmac/followers","following_url":"https://api.github.com/users/mtrmac/following{/other_user}","gists_url":"https://api.github.com/users/mtrmac/gists{/gist_id}","starred_url":"https://api.github.com/users/mtrmac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtrmac/subscriptions","organizations_url":"https://api.github.com/users/mtrmac/orgs","repos_url":"https://api.github.com/users/mtrmac/repos","events_url":"https://api.github.com/users/mtrmac/events{/privacy}","received_events_url":"https://api.github.com/users/mtrmac/received_events","type":"User","site_admin":false},"created_at":"2018-10-15T18:03:27Z","updated_at":"2018-10-15T18:03:27Z","author_association":"COLLABORATOR","body":"> I am unsure why the repository name is part of signature\r\n\r\nThis is necessary so that you don’t get ISV’s correctly-signed `debug-image-with-unrestricted-remote-reverse-shell` when you wanted to install `hardened-application-image-with-a-single-restricted-port-open` from the same ISV. Or so that you don’t get vulnerable `product:0.0.1` when you wanted to install latest `product:10.3.2`.\r\n\r\n>, which makes it very difficult to mirror and submirror.\r\n\r\n`policy.json` does anticipate mirrors and supports the `exactReference`/`exactRepository` options for downloading from mirrors while requiring original signatures. I do agree that this probably needs improving (notably there should be a ”use this repo instead but require original tag”, and probably a more general “this repo namespace is a mirror of that other repo namespace, including any nested namespaces and repos and tags”)."}}
{"actor":{"display_login":"mtrmac"}}