I am trying to verify container images using Cosign.
Let's use the image csi-node-driver-registrar as an example. (the image doesn't matter as long as it is signed by the author)
I tried the following CLI command and it successfully verified the image:
cosign verify registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.3 --certificate-identity [email protected] --certificate-oidc-issuer https://accounts.google.com
However, I got the working values for "certificate-identity" and "certificate-oidc-issuer" by running the command with random wrong values. (so I saw the correct values in the error message) This is like a joke, isn't it?
So I really need some explanations about the following points:
- How does Cosign sign and verify images in the "keyless" mode?
I read the official document but it completely lost me. I understand the basic concept about signature (the private key encrypted hash code of the original data) and the verification (decrypt by the public key and compare the 2 pieces of hash code).
- How do I find the correct "certificate-identity" and "certificate-oidc-issuer" in case the image is not created/signed by me?
Many thanks!! I spent much time on Googling without any luck.