Verifying images from Tines Registry
Tines images can be verified using cosign. Download and install cosign, then run (subbing in the name of the image):
cosign verify \
--key ./cosign.pub \
registry.tines.com/tines/tines-app:latest
Use the following public key stored in cosign.pub
for verification:
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUnTLRvsoHNEC04P2aBriS8p+0dAb
LgXrtHxEyC4R+rh44PB0unsYAEdNeLvPDnnn7GigylmaFwOPeQzLJigV6Q==
-----END PUBLIC KEY-----
Verifying images from Dockerhub
Tines images can be verified using cosign. Download and install cosign, then run the following (subbing in the name of the image) using the public key above:
cosign verify \
--key ./cosign.pub \
docker.io/tines/tines-app:latest
Verifying images using Docker Content Trust (legacy)
Up until v33.0, we supported verifying by Docker Content Trust.
DOCKER_CONTENT_TRUST=1 docker pull tines/tines-app:latest