Dockerfile signing
Open
Nobody has claimed this yet.
- Dominant language
- Dockerfile
- Stars
- 439
- Forks
- 107
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
As far as I can tell the official docker images are not signed. This means these images will fail to download in environments where docker content trust is configured. It would be nice if this was done.
# docker trust inspect pandoc/core
[]
no signatures or cannot access pandoc/core
Pulling docker image pandoc/extra ...
WARNING: Failed to pull image with policy "always": missing signature key
ERROR: Job failed: failed to pull image "pandoc/extra" with specified policies [always]: missing signature key
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No specific file or test is named. Start by inspecting how the repository publishes the pandoc/core and pandoc/extra images, then run the provided docker trust inspect and pull examples; the work is done when official images have signatures accepted by Docker Content Trust.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100