releng/tickets

Fork 2

Sign container images #10624

New issue

Open

opened 2022-02-07 22:50:13 +00:00 by demiobenour · 14 comments

demiobenour commented

2022-02-07 22:50:13 +00:00

Describe the issue

Fedora’s container images should be signed by official Fedora project keys, just like Red Hat’s are.
When do you need this? (YYYY/MM/DD)

2022/02/21 but sooner would be amazing
When is this no longer needed or useful? (YYYY/MM/DD)

N/A — sooner is better than later, but later is better than never
If we cannot complete your request, what is the impact?

Qubes OS will need to generate and sign its own container images, since it cannot verify the authenticity of ones shipped by Fedora.

* Describe the issue Fedora’s container images should be signed by official Fedora project keys, just like Red Hat’s are. * When do you need this? (YYYY/MM/DD) 2022/02/21 but sooner would be amazing * When is this no longer needed or useful? (YYYY/MM/DD) N/A — sooner is better than later, but later is better than never * If we cannot complete your request, what is the impact? Qubes OS will need to generate and sign its own container images, since it cannot verify the authenticity of ones shipped by Fedora.

zlopez commented

2022-02-08 09:53:11 +00:00

Member

Metadata Update from @zlopez:

Issue tagged with: meeting

**Metadata Update from @zlopez**: - Issue tagged with: meeting

humaton commented

2022-02-08 16:21:36 +00:00

Owner

Any ideas about how to approach this? @cverna @otaylor

amedvede commented

2025-10-06 11:30:40 +00:00

Owner

Metadata Update from @amedvede:

Issue tagged with: sprint-2

**Metadata Update from @amedvede**: - Issue tagged with: sprint-2

amedvede commented

2025-10-06 16:13:09 +00:00

Owner

@demiobenour Do it still needed?

amedvede commented

2025-10-06 16:13:10 +00:00

Owner

Metadata Update from @amedvede:

Issue assigned to amedvede

**Metadata Update from @amedvede**: - Issue assigned to amedvede

demiobenour commented

2025-10-06 16:31:30 +00:00

Author

@amedvede if it hasn't been implemented, it's still needed.

jcline commented

2025-10-06 17:13:57 +00:00

Related to this, travier requested a way to use cosign to sign containers. Those wouldn't be GPG signatures, though.

Related to this, [travier](https://github.com/fedora-infra/siguldry/issues/49) requested a way to use cosign to sign containers. Those wouldn't be GPG signatures, though.

jnsamyak commented

2025-10-07 08:35:02 +00:00

Owner

Metadata Update from @jnsamyak:

Issue tagged with: medium-gain, medium-trouble

**Metadata Update from @jnsamyak**: - Issue tagged with: medium-gain, medium-trouble

amedvede commented

2025-10-08 18:26:13 +00:00

Owner

Investigating it

amedvede commented

2025-10-20 11:13:02 +00:00

Owner

Issue tagged with: sprint-3

amedvede commented

2025-11-03 12:42:26 +00:00

Owner

Issue tagged with: sprint-4

jnsamyak commented

2025-11-04 09:00:27 +00:00

Owner

Metadata Update from @jnsamyak:

Issue untagged with: sprint-2, sprint-3

**Metadata Update from @jnsamyak**: - Issue **un**tagged with: sprint-2, sprint-3

amedvede commented

2025-11-07 11:41:43 +00:00

Owner

Hey all, lets go deep into this problem and hopefully will fix it soon enough

We making 3 container images fedora-base, fedora-minimal, fedora-toolbox and sync those images to quay.io, we build them using pungi. And here I see at least in description that it uses kickstarts to build container image for docker hub. So question is what exactly images you would to be signed?
2)As far as I know we don't support to update dockerhub, and it should be documented somewhere. Can you suggest the place where? Also fix if I'm mistaking.
3)Can you verify that image is still not signed? because pungi config has variable sigkey so it might be signed indeed. Would like to mention that I'm not an expert in signing and just trying to learn how this process works so fix me where I'm wrong.
4)If it still needed I believe it should be done on on pungi side

Hey all, lets go deep into this problem and hopefully will fix it soon enough 1) We making 3 container images `fedora-base`, `fedora-minimal`, `fedora-toolbox` and sync those images to quay.io, we build them using pungi. And [here](https://github.com/fedora-cloud/docker-brew-fedora) I see at least in description that it uses kickstarts to build container image for docker hub. So question is what exactly images you would to be signed? 2)As far as I know we don't support to update dockerhub, and it should be documented somewhere. Can you suggest the place where? Also fix if I'm mistaking. 3)Can you verify that image is still not signed? because `pungi` config has variable `sigkey` so it might be signed indeed. Would like to mention that I'm not an expert in signing and just trying to learn how this process works so fix me where I'm wrong. 4)If it still needed I believe it should be done on on pungi side

kevin referenced this issue

2025-12-04 22:59:21 +00:00

Switching quay.io/fedora/fedora-bootc to be built by Konflux #13115

siosm commented

2026-01-26 11:19:23 +00:00

As far as I know the Fedora container images are still not signed.

As Jeremy mentioned, I requested in https://github.com/fedora-infra/siguldry/issues/49 support for cosign signatures.

In the mean time, we are currently signing Fedora CoreOS container images with GPG signatures (https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/17fcos-container-signing/etc/containers/registries.d/fedora-coreos.yaml) but this is not ideal.

As far as I know the Fedora container images are still not signed. As Jeremy mentioned, I requested in https://github.com/fedora-infra/siguldry/issues/49 support for cosign signatures. In the mean time, we are currently signing Fedora CoreOS container images with GPG signatures (https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/17fcos-container-signing/etc/containers/registries.d/fedora-coreos.yaml) but this is not ideal.

jnsamyak added this to the Backlog project

2026-04-30 08:47:22 +00:00

jnsamyak added

and removed

labels

2026-04-30 09:21:27 +00:00