Understand how to use sigstore to verify container signatures
To verify image integrity within your MicroShift environment, you can configure the container runtime to use the sigstore signing methodology. This ensures a safer chain of custody by enabling the digital signing and verification of build artifacts.
-
For user-specific images, you must update the configuration file to point to the appropriate public key, or disable signature verification for those image sources.
|
|
For disconnected or offline configurations, you must embed the public key contents into the operating system image. |