You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/container-registry/container-registry-tutorial-sign-build-push.md
+13-5Lines changed: 13 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.date: 4/23/2023
11
11
12
12
# Sign container images with Notation and Azure Key Vault using a self-signed certificate
13
13
14
-
Signing container images is a process that ensures their authenticity and integrity. This is achieved by adding a digital signature to the container image, which can be validated during deployment. The signature helps to verify that the image is from a trusted publisher and has not been modified. [Notation](https://github.com/notaryproject/notation) is an open source supply chain tool developed by the [Notary Project](https://notaryproject.dev/), which supports signing and verifying container images and other artifacts. The Azure Key Vault (AKV) is used to store certificates with signing keys that can be used by Notation with the Notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach signatures to container images and other artifacts as well as view those signatures.
14
+
Signing container images is a process that ensures their authenticity and integrity. This is achieved by adding a digital signature to the container image, which can be validated during deployment. The signature helps to verify that the image is from a trusted publisher and has not been modified. [Notation](https://github.com/notaryproject/notation) is an open source supply chain security tool developed by the [Notary Project community](https://notaryproject.dev/) and backed by Microsoft, which supports signing and verifying container images and other artifacts. The Azure Key Vault (AKV) is used to store certificates with signing keys that can be used by Notation with the Notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach signatures to container images and other artifacts as well as view those signatures.
15
15
16
16
In this tutorial:
17
17
@@ -41,16 +41,16 @@ In this tutorial:
41
41
cp ./notation /usr/local/bin
42
42
```
43
43
44
-
2. Install the Notation Azure Key Vault plugin `azure-kv` v1.1.0 on a Linux amd64 environment.
44
+
2. Install the Notation Azure Key Vault plugin `azure-kv` v1.2.0 on a Linux amd64 environment.
45
45
46
46
> [!NOTE]
47
47
> The URL and SHA256 checksum for the Notation Azure Key Vault plugin can be found on the plugin's [release page](https://github.com/Azure/notation-azure-kv/releases).
3. List the available plugins and confirm that the `azure-kv` plugin with version `1.1.0` is included in the list.
53
+
3. List the available plugins and confirm that the `azure-kv` plugin with version `1.2.0` is included in the list.
54
54
55
55
```bash
56
56
notation plugin ls
@@ -345,6 +345,14 @@ To verify the container image, add the root certificate that signs the leaf cert
345
345
346
346
## Next steps
347
347
348
-
See [Use Image Integrity to validate signed images before deploying them to your Azure Kubernetes Service (AKS) clusters (Preview)](/azure/aks/image-integrity?tabs=azure-cli) and [Ratify on Azure](https://ratify.dev/docs/1.0/quickstarts/ratify-on-azure/) to get started into verifying and auditing signed images before deploying them on AKS.
348
+
Notation also provides CI/CD solutions on Azure Pipeline and GitHub Actions Workflow:
349
+
350
+
- [Sign and verify a container image with Notation in Azure Pipeline](/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign)
351
+
- [Sign and verify a container image with Notation in GitHub Actions Workflow](https://github.com/marketplace/actions/notation-actions)
352
+
353
+
To validate signed image deployment in AKS or Kubernetes:
354
+
355
+
- [Use Image Integrity to validate signed images before deploying them to your Azure Kubernetes Service (AKS) clusters (Preview)](/azure/aks/image-integrity?tabs=azure-cli)
356
+
- [Use Ratify to validate and audit image deployment in any Kubernetes cluster](https://ratify.dev/)
Copy file name to clipboardExpand all lines: articles/container-registry/container-registry-tutorial-sign-trusted-ca.md
+14-6Lines changed: 14 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ Signing and verifying container images with a certificate issued by a trusted Ce
15
15
16
16
Here are some essential components that help you to sign and verify container images with a certificate issued by a trusted CA:
17
17
18
-
* The [Notation](https://github.com/notaryproject/notation) is an open-source supply chain tool developed by [Notary Project](https://notaryproject.dev/), which supports signing and verifying container images and other artifacts.
18
+
* The [Notation](https://github.com/notaryproject/notation) is an open-source supply chain security tool developed by [Notary Project community](https://notaryproject.dev/) and backed by Microsoft, which supports signing and verifying container images and other artifacts.
19
19
* The Azure Key Vault (AKV), a cloud-based service for managing cryptographic keys, secrets, and certificates will help you ensure to securely store and manage a certificate with a signing key.
20
20
* The [Notation AKV plugin azure-kv](https://github.com/Azure/notation-azure-kv), the extension of Notation uses the keys stored in Azure Key Vault for signing and verifying the digital signatures of container images and artifacts.
21
21
* The Azure Container Registry (ACR) allows you to attach these signatures to the signed image and helps you to store and manage these container images.
@@ -53,17 +53,17 @@ In this article:
53
53
cp ./notation /usr/local/bin
54
54
```
55
55
56
-
2. Install the Notation Azure Key Vault plugin `azure-kv` v1.1.0 on a Linux amd64 environment.
56
+
2. Install the Notation Azure Key Vault plugin `azure-kv` v1.2.0 on a Linux amd64 environment.
57
57
58
58
> [!NOTE]
59
59
> The URL and SHA256 checksum for the Notation Azure Key Vault plugin can be found on the plugin's [release page](https://github.com/Azure/notation-azure-kv/releases).
3. List the available plugins and confirm that the `azure-kv` plugin with version `1.1.0` is included in the list.
66
-
65
+
3. List the available plugins and confirm that the `azure-kv` plugin with version `1.2.0` is included in the list.
66
+
67
67
```bash
68
68
notation plugin ls
69
69
```
@@ -394,6 +394,14 @@ To learn more about assigning policy to a principal, see [Assign Access Policy](
394
394
395
395
## Next steps
396
396
397
-
See [Use Image Integrity to validate signed images before deploying them to your Azure Kubernetes Service (AKS) clusters (Preview)](/azure/aks/image-integrity?tabs=azure-cli) and [Ratify on Azure](https://ratify.dev/docs/1.0/quickstarts/ratify-on-azure/) to get started into verifying and auditing signed images before deploying them on AKS.
397
+
Notation also provides CI/CD solutions on Azure Pipeline and GitHub Actions Workflow:
398
+
399
+
- [Sign and verify a container image with Notation in Azure Pipeline](/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign)
400
+
- [Sign and verify a container image with Notation in GitHub Actions Workflow](https://github.com/marketplace/actions/notation-actions)
401
+
402
+
To validate signed image deployment in AKS or Kubernetes:
403
+
404
+
- [Use Image Integrity to validate signed images before deploying them to your Azure Kubernetes Service (AKS) clusters (Preview)](/azure/aks/image-integrity?tabs=azure-cli)
405
+
- [Use Ratify to validate and audit image deployment in any Kubernetes cluster](https://ratify.dev/)
0 commit comments