pushing signed docker images to GCR

Question

Somewhat of a GCR newbie question.

I have not been able to find any documentation on whether it is possible to push signed docker images to GCR. So I attempted it but it fails with following error below. I first built a docker image, then tagged it to point to my project in GCR with "docker tag gcr.io/my-project/image-name:tag" Then attempted signing using "docker trust sign gcr.io/my-project/image-name:tag"

Error: error contacting notary server: denied: Token exchange failed for project 'gcr.io:my-project'. Please enable Google Container Registry API in Cloud Console at https://console.cloud.google.com/apis/api/containerregistry.googleapis.com/overview?project=gcr.io:my-project before performing this operation.

GCR API for my project is enabled and I have permissions to push to it.

Do I need to something more in my project in GCP to be able to push signed images OR it is just not supported?

If later, how does one (as a image consumer) verify the integrity of the image?

thanks, J

Answer 1

This is currently not supported in Google Cloud Platform.

You can file a feature request to request its implementation here.

To verify an images integrity, use image digests. Basically they are cryptographic hashes associated with the image. You can compare the hash of the image you pulled with the hash you are expecting. Command reference here

Answer 2

Google now implements the concept of Binary Authorization and "attestations" based off of Kritis. The intention is for this to be used within your CI/CD pipeline to ensure images have been created and validated correctly.

Full docs are here but the process basically consists of signing an image via a PKIX signature and then using the gcloud tool to create an attestation.

You then specify a Binary Authorization policy on your GKE cluster to enforce which attestations are required before an image is allowed to be used within the cluster.