podman-image-sign(1)

💖 podman-image-sign — the manual page, but make it cute 💖

okay so bestie, welcome to podman-image-sign(1) from the General Commands Manual 🎀 this is the whole page, every last crumb of it, just with 1000% more sparkle ✨

---

✨ NAME ✨

podman-image-sign — Create a signature for an image 🖊️

🌸 SYNOPSIS 🌸

podman image sign [options] image [image ...]

💅 DESCRIPTION 💅

okay so podman image sign creates a local signature for one or more local images that have been pulled from a registry. no cap, that's the whole job 🫶

the signature gets written to a directory derived from the registry configuration files in $HOME/.config/containers/registries.d if that exists — otherwise /etc/containers/registries.d (unless it got overridden at compile-time, which is a thing that can happen, iykyk). go check containers-registries.d(5) for the deets 📖

by default, the signature is written into /var/lib/containers/sigstore for root, and $HOME/.local/share/containers/sigstore for non-root users. lowkey neat 🌈

---

👑 OPTIONS 👑

• --all, -a — Sign all the manifests of the multi-architecture image (default false). it's giving "everybody gets a signature" 💫
• --authfile=path — Path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json on Linux, and $HOME/.config/containers/auth.json on Windows/macOS. This file is created by podman login. If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using docker login. 🔐

Note: there's also the option to override the default path of the authentication file by setting the REGISTRY_AUTH_FILE environment variable. Do it like this: export REGISTRY_AUTH_FILE=path.

• --cert-dir=path — Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. (Default: /etc/containers/certs.d) For details, see containers-certs.d(5). 🎀

heads up bestie: this option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines 😭

• --directory, -d=dir — Store the signatures in the specified directory. Default: /var/lib/containers/sigstore 📁
• --help, -h — Print usage statement. the classic "what do I do now" button 🙈
• --sign-by=identity — Override the default identity of the signature. main character energy, but for your keyring 👑

---

🔥 EXAMPLES 🔥

Sign the busybox image with the identity of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/. slay 💖

$ sudo podman image sign --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar

$ sudo podman image sign --authfile=/tmp/foobar.json --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar

---

🧚 RELATED CONFIGURATION 🧚

the write (and read) location for signatures is defined in YAML-based configuration files in /etc/containers/registries.d/ for root, or $HOME/.config/containers/registries.d for non-root users. when signing an image, Podman uses those configuration files to determine where to write the signature, based on the name of the originating registry or a default storage value — unless you override it with the --directory option. periodt 💅

for example, consider the following configuration file:

docker:
  privateregistry.example.com:
    sigstore: file:///var/lib/containers/sigstore

when signing an image preceded with the registry name 'privateregistry.example.com', the signature is written into sub-directories of /var/lib/containers/sigstore/privateregistry.example.com. and the use of 'sigstore' also means the signature is 'read' from that same location on a pull-related function. it's the same house for reading and writing, iconic 🏠✨

---

⭐ SEE ALSO ⭐

containers-certs.d(5), containers-registries.d(5)

---

📜 HISTORY 📜

November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com) 🫶

---

and that's the whole podman-image-sign(1) page bestie, from the General Commands Manual, originally compiled back in November 2018 — go forth and sign your images, you absolute legend 👑💖 no cap