Recent container images published to quay.io lack signatures

Problem Description

The recent container images for the Prometheus Node Exporter published to the quay.io registry are lacking signatures. The images for versions 0.16.0 and 0.17.0 are signed as expected by rkt, but the images for versions 0.18.0 and 0.18.1 are not signed.

It's not possible to use rkt fetch against these latter two images without employing the --insecure-options=image command-line flag.

Details

Host operating system: output of uname -a

Linux ip-10-132-114-217 4.19.50-coreos-r1 #1 SMP Mon Jul 1 19:07:03 -00 2019 x86_64 Intel(R) Xeon(R) Platinum 8175M CPU @ 2.50GHz GenuineIntel GNU/Linux

node_exporter version: output of node_exporter --version

node_exporter, version 0.18.1 (branch: HEAD, revision: 3db77732e925c08f675d7404a8c46466b2ece83e)
  build user:       root@b50852a1acba
  build date:       20190604-16:41:18
  go version:       go1.12.5

node_exporter command line flags

(Not applicable)

Are you running node_exporter in Docker?

No, but with rkt.

What did you do that produced an error?

rkt fetch quay.io/prometheus/node-exporter:v0.18.1

What did you expect to see?

rkt should be able to download both the image layers and an accompanying signature, as we see here when downloading the image for version 0.17.0:

% rkt --debug fetch quay.io/prometheus/node-exporter:v0.17.0
image: searching for app image quay.io/prometheus/node-exporter
image: remote fetching from URL "https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.17.0/aci/linux/amd64/"
image: fetching image from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.17.0/aci/linux/amd64/
image: keys already exist for prefix "quay.io/prometheus/node-exporter", not fetching again
image: downloading signature from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.17.0/aci.asc/linux/amd64/
Downloading signature: [=======================================] 473 B/473 B
Downloading ACI: [=============================================] 10.5 MB/10.5 MB
image: signature verified:
  Quay.io ACI Converter (ACI conversion signing key) <support@quay.io>
sha512-8c4949449e3eabfbcd272d40e196f739

What did you see instead?

rkt is unable to download the accompanying signature, which doesn't exist for the images published for versions 0.18.0 and 0.18.1.

Version 0.18.1:

% rkt --debug fetch quay.io/prometheus/node-exporter:v0.18.1
image: searching for app image quay.io/prometheus/node-exporter
image: remote fetching from URL "https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.1/aci/linux/amd64/"
image: fetching image from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.1/aci/linux/amd64/
image: keys already exist for prefix "quay.io/prometheus/node-exporter", not fetching again
image: downloading signature from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.1/aci.asc/linux/amd64/
image: server requested deferring the signature download
Downloading ACI: [=============================================] 11.7 MB/11.7 MB
image: downloading signature from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.1/aci.asc/linux/amd64/
image: server requested deferring the signature download
fetch: 
  └─error downloading the signature file: server asked to defer the download again

Version 0.18.0:

rkt --debug fetch quay.io/prometheus/node-exporter:v0.18.0
image: searching for app image quay.io/prometheus/node-exporter
image: remote fetching from URL "https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.0/aci/linux/amd64/"
image: fetching image from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.0/aci/linux/amd64/
image: keys already exist for prefix "quay.io/prometheus/node-exporter", not fetching again
image: downloading signature from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.0/aci.asc/linux/amd64/
image: server requested deferring the signature download
Downloading ACI: [=============================================] 11.7 MB/11.7 MB
image: downloading signature from https://quay.io/c1/aci/quay.io/prometheus/node-exporter/v0.18.0/aci.asc/linux/amd64/
image: server requested deferring the signature download
fetch: 
  └─error downloading the signature file: server asked to defer the download again

Did the maintainers of this project decide to stop signing these images, or is this an oversight that we can correct, even if only for future images?

Start by comparing the quay.io tags and rkt fetch output for node-exporter versions 0.17.0, 0.18.0, and 0.18.1, including the ACI and signature URLs shown in the report. Determine whether the release process omitted signatures; done means future or corrected images provide an accompanying signature that rkt can download and verify without insecure options.