'How do I sign an image in skopeo with multiple tags without overwriting each other?
From what I understand, when signing/pushing an image in skopeo, you can create multiple signatures. Here is essentially what I am trying to do:
podman build -t tester:1.0 .
podman tag tester:1.0 tester:latest
skopeo copy --sign-by <fingerprint> containers-storage:localhost/tester:1.0 docker://registry:5000/tester:1.0
skopeo copy --sign-by <fingerprint> containers-storage:localhost/tester:latest docker://registry:5000/tester:latest
What I am expecting is to see multiple signatures under /var/lib/containers/sigstore/tester\@sha256\=<hash>/ something along the lines of signature-1, signature-2. But what I am actually seeing is that signature-1 gets generated after the first skopeo copy command, and then is overwritten after the second. If I upload this signature to the sigstore, then I can pull the latest tag, but if I pull 1.0 then I get the following error:
Trying to pull registry:5000/tester:1.0...
Error: Source image rejected: None of the signatures were accepted, reasons: Signature for identity registry:5000/tester:latest is not accepted; Signature for identity registry:5000/tester:latest is not accepted
This is because the overwritten signature is for the identity registry:5000/tester:latest since that is the last tag that was pushed. Why is it being overwritten? How do I have skopeo assign a separate signature for each identity (tag)?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
