Validate Notary v2 signatures of upstream base images during CopyBaseImages
Open
area-infrastructure
- Dominant language
- C#
- Stars
- 181
- Forks
- 67
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 10
Description
Currently, `CopyBaseImagesCommand` copies external base images into ACR without verifying their signatures:
https://github.com/dotnet/docker-tools/blob/6b2d022bdc30337399970a962c2c933ee95d2c8c/src/ImageBuilder/Commands/CopyBaseImagesCommand.cs#L82-L105
We should verify the Notary v2 signature of each base image before importing it into the build registry. Not all upstream images have Notary v2 signatures, so verification should be opt-in and enabled wherever signatures are available.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.