Trusted pulls from notary server are not supported
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.2k
- Forks
- 1.7k
- Avg merge
- 13d 8h
- Merged PRs (30d)
- 2
Description
This is related to https://github.com/docker/compose/issues/4787.
There doesn't seem to be any way within the Python API to get the equivalent of what the Go CLI supports via the DOCKER_CONTENT_TRUST and DOCKER_CONTENT_TRUST_SERVER environment variables as described here:
https://docs.docker.com/engine/security/trust/trust_sandbox/
Since docker-compose is based on docker-py, that would seem it can't do trusted pulls. Is that right? If so, that's a fairly serious limitation.
Is there any plan or timeline to add support for notary servers? There is a Python library which implements tuf support (https://github.com/theupdateframework/tuf), so adding support for a notary server to docker-py would seem to be a matter of integrating it the same way the Go bindings are used in docker/cli.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the Python API with the Go CLI behavior for DOCKER_CONTENT_TRUST and DOCKER_CONTENT_TRUST_SERVER, using the linked Docker Engine trust documentation as context. Review how docker-py integrates with Docker Engine and assess the referenced TUF library and notary-server requirements. Done means trusted pulls through the Python API are supported and their behavior is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100