# 启用内容信任
export DOCKER_CONTENT_TRUST=1

# 或永久启用
echo 'export DOCKER_CONTENT_TRUST=1' >> ~/.bashrc

# 1. 生成签名密钥（首次使用）
docker trust key generate mykey
# 生成 root 密钥和仓库密钥

# 2. 签名并推送镜像
export DOCKER_CONTENT_TRUST=1
docker build -t myrepo/myapp:1.0 .
docker push myrepo/myapp:1.0
# 推送过程会自动签名

# 启用内容信任后拉取会自动验证
export DOCKER_CONTENT_TRUST=1
docker pull myrepo/myapp:1.0
# 如果签名无效或未签名，拉取失败

# 手动查看签名信息
docker trust inspect --pretty myrepo/myapp:1.0

# 查看密钥列表
docker trust key list

# 添加签名者
docker trust signer add --key mykey.pub alice myrepo/myapp

# 撤销签名者
docker trust signer remove alice myrepo/myapp

# 恢复密钥
docker trust key load mykey.pem --name mykey

# 启动 Notary 服务
docker run -d -p 4443:4443 \
  -v $(pwd)/config:/etc/notary \
  notary-server

# 使用 Notary CLI
notary list myrepo/myapp

# 添加签名
notary add myrepo/myapp 1.0 \
  --sha256 abc123... \
  --publish

# 安装 Cosign
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
mv cosign-linux-amd64 /usr/local/bin/cosign
chmod +x /usr/local/bin/cosign

# 生成密钥对
cosign generate-key-pair

# 签名镜像
cosign sign --key cosign.key myrepo/myapp:1.0

# 验证签名
cosign verify --key cosign.pub myrepo/myapp:1.0

# 使用密钥管理服务（KMS）
cosign sign --key gcpkms://projects/... myrepo/myapp:1.0

$ cosign verify --key cosign.pub myrepo/myapp:1.0

Verification for myrepo/myapp:1.0 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified using the specified public key
[
  {
    "critical": {
      "identity": {
        "docker-reference": "myrepo/myapp"
      },
      "image": {
        "docker-manifest-digest": "sha256:abc123..."
      },
      "type": "cosign container image signature"
    },
    "optional": null
  }
]

name: Sign and Push

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - uses: actions/checkout@v3

      - name: Build and Push
        run: |
          docker build -t myrepo/myapp:${{ github.sha }} .
          docker push myrepo/myapp:${{ github.sha }}

      - name: Sign the Image
        uses: sigstore/cosign-installer@main
      - run: |
          cosign sign \
            --tlog-upload=false \
            --key env://COSIGN_PRIVATE_KEY \
            myrepo/myapp@${{ steps.push.outputs.digest }}
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

# Kubernetes 使用 Kyverno 验证签名
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image
spec:
  validationFailureAction: enforce
  rules:
    - name: verify-cosign
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - image: "myrepo/*"
          key: |
            -----BEGIN PUBLIC KEY-----
            ...
            -----END PUBLIC KEY-----

# 使用硬件安全模块（HSM）
# 使用密钥管理服务（AWS KMS, GCP KMS, Azure Key Vault）
# 使用 CI/CD secrets 管理

# 不要将私钥提交到 git
# 不要将私钥放在镜像中

# Cosign 密钥轮换
cosign generate-key-pair
cosign sign --key cosign.key myrepo/myapp:1.0

# 支持多密钥验证
cosign verify --key old.pub --key new.pub myrepo/myapp:1.0