• Importing a delegation certificate

    Importing a delegation certificate

    As a repository owner:

    1. Add the delegation key to the repository using the targets/releases path, as this is what Docker searches for when signing an image (first targets, then targets/releases:

      1. ❯ notary delegation -D -v -s https://127.0.0.1:4443 -d ~/.docker/trust add <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app targets/releases delegation.crt --all-paths
      3. Addition of delegation role targets/releases with keys [e93a68479026f002b9dedb35f563cf5abc50aecd18b2205ad296d3101c0d3c21], with paths ["" <all paths>], to repository "<aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app" staged for next publish.

    2. Check the unpublished (staged) changes:

      1. ❯ notary -D -v -s https://127.0.0.1:4443 -d ~/.docker/trust status <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
      3. Unpublished changes for <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app:
      5. #    ACTION    SCOPE               TYPE          PATH
      6. -    ------    -----               ----          ----
      7. 0    create    targets/releases    delegation
      8. 1    create    targets/releases    delegation

    3. Publish the queued changes:

      1. ❯ notary -v -s https://127.0.0.1:4443 -d ~/.docker/trust publish <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
      3. Pushing changes to <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
      4. Enter passphrase for targets key with ID 79a6fca:
      5. Successfully published changes for repository <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app

      Enter the previously created targets repository key passphrase.

    4. Confirm the delegation list looks correct:

      1. ❯ notary -v -s https://127.0.0.1:4443 -d ~/.docker/trust delegation list <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
      3. ROLE                PATHS             KEY IDS                    THRESHOLD
      4. ----                -----             -------                    ---------
      5. targets/releases    "" <all paths>    61a6430…                   1