SKOPEO-STANDALONE-SIGN(1)

💖 skopeo-standalone-sign(1) 💖

okay bestie, welcome to the skopeo-standalone-sign page — yes that's the whole manual name, it's giving "long title, tiny job" and we love her for it.

---

✨ NAME ✨

skopeo-standalone-sign — the debugging tool that signs an image locally, no uploading, no drama. 🫶

---

🎀 SYNOPSIS 🎀

skopeo standalone-sign [options] manifest docker-reference key-fingerprint --output|-o signature

---

🌸 DESCRIPTION 🌸

so like, real talk? This is primarily a debugging tool. It's here for the special cases, the weird little one-offs, and it usually should not be a part of your normal operational workflow. If you're out here living your best production life, you want skopeo copy --sign-by instead — that publishes <emphasis>and</emphasis> signs the image in one single step. iconic behavior. 💅

Anyway, the args, let's go:

• manifest — path to a file containing the image manifest. that's your file, bestie. 📄
• docker-reference — a docker reference to identify the image with. it's the image's name tag, essentially. 🏷️
• key-fingerprint — key identity to use for signing. the fingerprint of the key doing the signing. 🔑

---

✨ OPTIONS ✨

quick note before we dive in: options placed before the subcommand name live over in skopeo(1). 👑

• --help, -h — print the usage statement. the classic. the comfort flag. when in doubt, ask for help. 🙈
• --output, -o — write the signature to output file. yes, that's the output file, that's what it is, it writes the signature there. 💖
• --passphrase-file=path — the passphrase to use when signing with the key ID from --sign-by. only the first line gets read, so don't get cute with multi-line files.

🚨 okay serious moment: a passphrase stored in a file is of questionable security if other users can read that file. do not use this option if at all avoidable. like, at all. fr fr. 💀

---

🔥 EXAMPLES 🔥

here's the vibe, copy-paste ready:

$ skopeo standalone-sign busybox-manifest.json registry.example.com/example/busybox 1D8230F6CDB6A06716E414C1DB72F2188BB46CC8 --output busybox.signature
$

ate. no crumbs. 🍓

---

📝 NOTES 📝

• This command is intended for use with local signatures, e.g. OpenPGP (other signature formats may be added in the future, so stay tuned bestie), as per containers-signature(5).
• Also important: this command does not interact with the artifacts generated by Docker Content Trust (DCT). not it. 🙅

For more information, please see containers-signature(5) at ⟨https://github.com/containers/image/blob/main/docs/containers-signature.5.md⟩.

---

👀 SEE ALSO 👀

• skopeo(1)
• skopeo-copy(1)
• containers-signature(5)

---

💜 AUTHORS 💜

the literal icons who made this happen:

• Antonio Murdaca runcom@redhat.com ⟨mailto:runcom@redhat.com⟩
• Miloslav Trmac mitr@redhat.com ⟨mailto:mitr@redhat.com⟩
• Jhon Honce jhonce@redhat.com ⟨mailto:jhonce@redhat.com⟩

---

and that's the whole page, bestie. this one's from the skopeo-standalone-sign(1) manual, footer stamp and all — go sign something local, stay debuggy, and don't put your passphrase in a file if you can help it 💖✨🦋