Questions tagged [notary]

Notary is a tool for publishing and managing trusted collections of content. Publishers can digitally sign collections and consumers can verify integrity and origin of content. This ability is built on a straightforward key management and signing interface to create signed collections and configure trusted publishers.

Filter by
Sorted by
Tagged with
0 votes
1 answer
75 views

Docker notary client for multi-platform image publishing succeeds but tag is not trusted

I have been following the steps in the action script here closely (https://github.com/sudo-bot/action-docker-sign/blob/main/action.yml) to trust and sign a multi-platform image. The only modification ...
J.R.'s user avatar
  • 1,880
0 votes
1 answer
322 views

Corda Network-Map is up and running, but Notary is not in whitelist

I have a Corda Infrastructure with some nodes and a (not validating) notary. They're all using a Network Map for the compatibility zone, and all the corda nodes, including the notary, download the ...
Andrean's user avatar
  • 313
1 vote
1 answer
308 views

Is there a generic container signature validation method?

Does anyone have a good solution for a generic container signature verification? From what I've seen (please correct any mistakes) Docker Hub uses signatures based on "Notary", that needs ...
Max Allan's user avatar
  • 859
4 votes
0 answers
243 views

How to use Docker Content Trust to sign multi-arch images built with docker buildx?

I am trying to build, sign, and push a multi-arch container image using a Harbor registry with Notary. Following the steps in https://www.cncf.io/blog/2021/07/28/enforcing-image-trust-on-docker-...
Spencer Small's user avatar
1 vote
0 answers
27 views

How Docker Image consumer validate image origin

with docker content trust enabled, an image without trust metadata will not be downloaded. However, in the case where the trust metadata is present, the image will be pulled, so how does an image ...
yzftnt's user avatar
  • 83
1 vote
0 answers
86 views

Docker --build-arg ignored when using Content Trust in FROM instruction

I'd like to build an image using ARG and DOCKER_CONTENT_TRUST activated, with Docker v18.06.1-ce Dockerfile: ARG tag FROM busybox:${tag} Run docker build --build-arg tag=1.33.1 . OK Then, active ...
Jean-Baptiste Martin's user avatar
0 votes
1 answer
195 views

how to relate docker trust root key ID to actual root key file

Given that the Docker Content Trust is enabled, I can see the Root Key information when I inspect a repo as below. [root@lab admin]# docker trust inspect registry.XXXXXX.com/project/nginx --pretty ...
yzftnt's user avatar
  • 83
0 votes
2 answers
2k views

How can I be sure that I am pulling a trusted image from docker?

We are using notary service along with third party provider aujas for signing the docker images. I have a build machine from where we run the scripts to sign the images. So far so good. When my ...
srinu259's user avatar
  • 309
0 votes
1 answer
48 views

Check status of a flow hash in corda notary

How do I query the status of a flowID (or its hash) in the notary vault?(consumed/not-consumed). Thank you in advance.
JSilverII's user avatar
-1 votes
1 answer
158 views

docker: 'notary' is not a docker command

docker: 'notary' is not a docker command The above error is getting in docker ce (20.10.2~3-0~ubuntu-bionic). is it working in only enterprise edition ?
Jaya Surya P's user avatar
0 votes
2 answers
71 views

Error NOTARY_HOSTED_SIGNER_ID_REQUIRED when trying to send an eNotary envelope

Let my envelope be as below : { "allowReassign": "false", "documents": [ { "documentBase64": "JVBE", "...
Frederic's user avatar
  • 2,015
0 votes
1 answer
229 views

Notary cannot install Corda service

I was trying to configure Business network Operator services in my solution by adding the toolkit provided by r3 as corrdapp dependancy in my application.I am able to build the application but when I ...
Sil's user avatar
  • 25
0 votes
1 answer
58 views

Do BNO(Business Network Operator) have a Notary?

According to the Corda docs for eg: While on-boarding a node to Business network,if we want to approve a pending membership that has passed through the review and approval checks, BNO would approve it....
Sil's user avatar
  • 25
0 votes
1 answer
33 views

Access the Contract State within the Notary

I want to trigger a transaction in an External network from the Notary Service Flow just before consuming the Input State. The example is a Custodian service that triggers the notification to the ...
JSilverII's user avatar
1 vote
1 answer
52 views

Ordering of transactions in corda

I have a doubt regarding the ordering of transactions by the notary in corda. For instance, if there are two partys partyA and partyB, consuming a same input state, sends a txn at the same time to ...
Hari Prasath's user avatar
0 votes
1 answer
120 views

How are transactions counted in Corda toward the 10k free limit?

I can't find any documentation on what counts as a transaction and whose count it increases when a notary signs a transaction. Does only the initiating node have its transaction count increased? Or is ...
user13816817's user avatar
0 votes
1 answer
518 views

Corda notary prevention in double spending,how to check it?

I need to check how the notary prevents the double spending in the Obligation Cordapp. I started the web server UI at the localhost ports and performed some multiple transactions and when I checked ...
blueCoder's user avatar
2 votes
1 answer
212 views

How to generate custom Docker Content Trust root key

I have little idea in security aspects in and outside docker world. As the document states, I tried the below command docker trust key generate jeff Whenever I run this command first time it will ...
JibinNajeeb's user avatar
0 votes
1 answer
43 views

Does corda's notary save transaction inputstate or outputState specific information?

Does Notary only save output_index and transaction_id? Will Notary keep detailed State information?
lisa's user avatar
  • 43
1 vote
4 answers
4k views

docker push with local notary server returns error: x509: certificate signed by unknown authority

I have been working at setting up a docker notary on a Centos 8 machine. I followed the README.md for the notary project which tells me to use the testing certificate the project comes with by moving ...
Rijo Simon's user avatar
4 votes
1 answer
399 views

Signing docker images with delegation key only

I'm trying following scenario. On my laptop I have created a delegation key. On a server I have created the target and authorized my delegation key Now when signing my Docker image via docker trust I'...
Marco's user avatar
  • 4,827
1 vote
0 answers
109 views

Docker Content Trust Runtime enforcement: how to specify a separate content trust server url (notary)

I am trying to setup runtime enforcement with Docker Content Trust, as specified here: https://docs.docker.com/engine/security/trust/content_trust/#runtime-enforcement-with-docker-content-trust. { ...
nsx's user avatar
  • 21
0 votes
1 answer
53 views

Notary support in IBM Container Registry

I followed this guide to setup a content trust env and push an image. https://cloud.ibm.com/docs/Registry?topic=registry-registry_trustedcontent#trustedcontent_setup But seems the image is not signed ...
jiangmz's user avatar
3 votes
3 answers
619 views

Are there two root keys in Docker Content Trust?

I am new to the mechanism of Docker Content Trust (DCT) and a bit confused about the root key. The first time I add a signer to a new repository I am asked to enter passphrases for the root and ...
Joe's user avatar
  • 277
0 votes
1 answer
69 views

Java Tool Notarize process

we have developed GUI tool using Java SE 11 , packaged using Maven. Recommend user to download and set Java in system path to launch the tool. Batch file for windows and .command file for Mac and ...
krishnakumar's user avatar
0 votes
1 answer
95 views

Docusign - eNotary - 1 Notary Multiple Signers

We have a client setup, and they want to use docusign for all their documents. During a eNotary process, they want to have for example: Notary A -> Signer 1 Notary A -> Signer 2 **Notary A places ...
Jimmie Clark's user avatar
  • 1,878
0 votes
2 answers
122 views

Docusign - eNotary in Sandbox

I am using the sandbox account and trying to setup an eNotary Profile. Being that its a sandbox area, I would assume that I don't need a valid notary ID to create one. Can someone help me setup a ...
Jimmie Clark's user avatar
  • 1,878
1 vote
1 answer
211 views

Use a modified notary client for docker trust command

I am trying to set up docker so that it works with a modified version of notary, that pulls the private keys from my HSM. For this I am using this fork from notary: https://github.com/gemalto/notary ...
Edin Citaku's user avatar
5 votes
2 answers
1k views

Docker Trust: could not rotate trust to a new trusted root: failed to validate data with current trusted certificates

I've suddenly got this message after a month of docker trust working fine for me via GitLab CI. I have a Gitlab Runner that mounts the ~/.docker/trust (so its persisted) and pushes it to our QA ...
Tim's user avatar
  • 2,968
2 votes
1 answer
106 views

Corda BFT notary cluster halts after one replica goes down

TL;DR - BFT cluster with 4-5 notary nodes grinds to a halt when one replica is killed. I ran the notary demo and the Raft cluster (with 3 notary nodes) behaved as expected - when I kill the leader, ...
qlfu_qlfu's user avatar
0 votes
0 answers
413 views

How can I verify the signature of a docker image?

Let's say a company has pushed and signed an image on its own docker registry using its X509 certificate and corresponding private key issued by a public CA. Having a copy of their certificate on my ...
Marc's user avatar
  • 856
3 votes
2 answers
812 views

How to debug failing docker image signing with the Docker Hub registry/notary?

Since today I haven't been able to push new signed images to a Docker Hub private repository due to image signing failing. I have Docker Content Trust enabled. I don't know of any significant changes ...
Matti Mäki's user avatar
1 vote
1 answer
1k views

Artifactory default notary server

I am looking for artifactory default notary server . Dockerhub default notary server is notary.docker.io which is hosted on cloud. Does artifactory also supports any cloud notary server?
Divya Vyas's user avatar
1 vote
1 answer
725 views

Docker trust: how to sign image without pushing it to repository

We run private docker registry, and I am trying to use notary to add image signing. I have notary set up, and Docker client can sign images as it pushes to the registry. My problem is that we do ...
Sergei Genchev's user avatar
4 votes
3 answers
985 views

Docker Trust Initialization

When the initial trust on docker content trust with notary on tuf is initialized I understand how TUF, Notary and Content Trust works. But what is not clear to me is, how the initial trust is setup. ...
Flo's user avatar
  • 2,729
3 votes
2 answers
3k views

How do we setup docker notary-server, notary-signer, and notary-client for private registry such as nexus?

I have setup below infrastructure for notary: notary server notary signer mariadb database for both "notary server" and "notary signer" using docker-compose. I would like to use my private docker ...
chinmay's user avatar
  • 41
0 votes
2 answers
5k views

Can't Signing and pushing trust metadata in Notary

I am implementing Notary in a virtual machine. To have a reference, I have a docker registry on host A and I want to deploy Notary Server, Signer and CLI on host B to get push images to registry and ...
gmaurelia's user avatar
0 votes
1 answer
279 views

Docker Notary doesn't find Yubikey

I'm running Ubuntu 16 LTS with docker, Notary 0.4.3 and yubico-piv-tool 1.5.0 The piv tool works with the yubokey, can create certificates and also import them to the yubikey. Notary works okay as ...
Flo's user avatar
  • 2,729
3 votes
2 answers
5k views

Add environment variable to ECS host

I am trying to set an environment variable in the EC2 instance hosting ECS containers. The environment variable should be readable by the docker client on the EC2 instance at run time. I know it's ...
cyc115's user avatar
  • 645
0 votes
1 answer
276 views

Mirror docker content trust

TL;DR - how do I run a (potentially insecure) docker registry mirror and trust the content? I have a series of devices running docker containers on a closed network with no internet access. I'm able ...
Johnny5's user avatar
  • 11
4 votes
2 answers
16k views

notary returns Error: unknown shorthand flag: 'r' in -r

I want to use delegates with DOCKER CONTENT TRUST. I generated the delegate.crt/key on the collaborator's machine and now I am trying to rotate the snapshot key with: notary key rotate localhost:5000/...
BiltiuLena's user avatar