Skip to content

Commit 98c8d73

Browse files
committed
Add manual line breaks and minor edits based on feedback
1 parent 9999d3a commit 98c8d73

File tree

1 file changed

+23
-12
lines changed

1 file changed

+23
-12
lines changed

content/en/docs/tasks/administer-cluster/verify-signed-artifacts.md

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,6 @@ weight: 420
1111

1212
## {{% heading "prerequisites" %}}
1313

14-
These instructions are for Kubernetes v{{< skew currentVersion >}}. If you want
15-
to check the integrity of components for a different version of Kubernetes,
16-
check the documentation for that Kubernetes release.
17-
1814
You will need to have the following tools installed:
1915

2016
- `cosign` ([install guide](https://docs.sigstore.dev/cosign/installation/))
@@ -45,14 +41,17 @@ done
4541
Then verify the blob by using `cosign verify-blob`:
4642

4743
```shell
48-
cosign verify-blob "$BINARY" --signature "$BINARY".sig --certificate "$BINARY".cert --certificate-identity [email protected] --certificate-oidc-issuer https://accounts.google.com
44+
cosign verify-blob "$BINARY" \
45+
--signature "$BINARY".sig \
46+
--certificate "$BINARY".cert \
47+
--certificate-identity [email protected] \
48+
--certificate-oidc-issuer https://accounts.google.com
4949
```
5050

5151
{{< note >}}
5252
Cosign 2.0 requires the `--certificate-identity` and `--certificate-oidc-issuer` options.
5353

54-
To learn more about keyless signing, please refer to [Keyless
55-
Signatures](https://docs.sigstore.dev/cosign/keyless).
54+
To learn more about keyless signing, please refer to [Keyless Signatures](https://docs.sigstore.dev/cosign/keyless).
5655

5756
Previous versions of Cosign required that you set `COSIGN_EXPERIMENTAL=1`.
5857

@@ -68,26 +67,38 @@ Pick one image from this list and verify its signature using
6867
the `cosign verify` command:
6968

7069
```shell
71-
cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}} --certificate-identity [email protected] --certificate-oidc-issuer https://accounts.google.com | jq .
70+
cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}} \
71+
--certificate-identity [email protected] \
72+
--certificate-oidc-issuer https://accounts.google.com \
73+
| jq .
7274
```
7375

7476
### Verifying images for all control plane components
7577

76-
To verify all signed control plane images for the latest stable version (v{{< skew currentPatchVersion >}}), please run the following commands:
78+
To verify all signed control plane images for the latest stable version
79+
(v{{< skew currentPatchVersion >}}), please run the following commands:
7780

7881
```shell
79-
curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" | grep "SPDXID: SPDXRef-Package-registry.k8s.io" | grep -v sha256 | cut -d- -f3- | sed 's/-/\//' | sed 's/-v1/:v1/' | sort > images.txt
82+
curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" \
83+
| grep "SPDXID: SPDXRef-Package-registry.k8s.io" \
84+
| grep -v sha256 | cut -d- -f3- | sed 's/-/\//' | sed 's/-v1/:v1/' \
85+
| sort > images.txt
8086
input=images.txt
8187
while IFS= read -r image
8288
do
83-
cosign verify "$image" --certificate-identity [email protected] --certificate-oidc-issuer https://accounts.google.com | jq .
89+
cosign verify "$image" \
90+
--certificate-identity [email protected] \
91+
--certificate-oidc-issuer https://accounts.google.com \
92+
| jq .
8493
done < "$input"
8594
```
8695

8796
Once you have verified an image, you can specify the image by its digest in your Pod
8897
manifests as per this example:
8998

90-
`registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2`
99+
```console
100+
registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
101+
```
91102

92103
For more information, please refer
93104
to the [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy)

0 commit comments

Comments
 (0)