-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
4.13, 4.12, 4.14, 4.15
-
None
-
None
-
False
-
Description of problem:
UnderĀ Using skopeo to verify signatures of Red Hat container images
Version-Release number of selected component (if applicable): all probably Actual results: Get the signature file for the specific release that you want to verify by running the following command: $ curl -o signature-1 https://mirror.openshift.com/pub/openshift-v4/signatures/openshift-release-dev/ocp-release/sha256%<sha_from_version>/signature-1 \ Replace <sha_from_version> with SHA value from the full link to the mirror site that matches the SHA of your release. For example, the link to the signature for the 4.12.23 release is https://mirror.openshift.com/pub/openshift-v4/signatures/openshift-release-dev/ocp-release/sha256%e73ab4b33a9c3ff00c9f800a38d69853ca0c4dfa5a88e3df331f66df8f18ec55/signature-1, and the SHA value is e73ab4b33a9c3ff00c9f800a38d69853ca0c4dfa5a88e3df331f66df8f18ec55. Expected results: Get the signature file for the specific release that you want to verify by running the following command: $ curl -o signature-1 https://mirror.openshift.com/pub/openshift-v4/signatures/openshift-release-dev/ocp-release/sha256=<sha_from_version>/signature-1 \ Replace <sha_from_version> with SHA value from the full link to the mirror site that matches the SHA of your release. For example, the link to the signature for the 4.12.23 release is https://mirror.openshift.com/pub/openshift-v4/signatures/openshift-release-dev/ocp-release/sha256=e73ab4b33a9c3ff00c9f800a38d69853ca0c4dfa5a88e3df331f66df8f18ec55/signature-1, and the SHA value is e73ab4b33a9c3ff00c9f800a38d69853ca0c4dfa5a88e3df331f66df8f18ec55. Additional info: In the original URL given for this doc, the "=" was escaped as "%3D". This text seems to have removed the "3D" part of that. You can either put "%3D" or "=", both will work in most contexts, the latter is certainly less confusing.