Enable sigstore attachments for mirror registries

If you are using mirror registries, you must apply additional configuration to enable sigstore attachments and mirroring by digest.

Prerequisites

  • You have admin access to the MicroShift host.

  • You completed the steps in "Verifying container signatures using sigstore."

Procedure

  1. Enable sigstore attachments by creating the /etc/containers/registries.d/mirror.registry.local.yaml file.

    $ cat /etc/containers/registries.d/<mirror.registry.local.yaml>
docker:
   mirror.registry.local:
        use-sigstore-attachments: true

    Name the <mirror.registry.local.yaml> file after your mirror registry URL.

  2. Enable mirroring by digest by creating the /etc/containers/registries.conf.d/999-microshift-mirror.conf with the following contents:

    $ cat /etc/containers/registries.conf.d/999-microshift-mirror.conf
[[registry]]
    prefix = "quay.io/openshift-release-dev"
    location = "mirror.registry.local"
    mirror-by-digest-only = true

[[registry]]
    prefix = "registry.redhat.io"
    location = "mirror.registry.local"
    mirror-by-digest-only = true
Next steps

  1. Wipe the local container storage clean.

← Previous: Verify container signatures using sigstore | ↑ Up: Understand how to use sigstore to verify container signatures | ⌂ Home: Red Hat build of MicroShift | Next: Wipe local container storage clean →