Verifying Tines images

Last updated August 25, 2025•Open markdown version^↗

Verifying images from Tines Registry

Tines images can be verified using cosign^↗. Download and install cosign, then run (subbing in the name of the image):

cosign verify \
  --key ./cosign.pub \
  registry.tines.com/tines/tines-app:latest

Use the following public key stored in cosign.pub for verification:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUnTLRvsoHNEC04P2aBriS8p+0dAb
LgXrtHxEyC4R+rh44PB0unsYAEdNeLvPDnnn7GigylmaFwOPeQzLJigV6Q==
-----END PUBLIC KEY-----

Verifying images from Dockerhub

Tines images can be verified using cosign^↗. Download and install cosign, then run the following (subbing in the name of the image) using the public key above:

cosign verify \
  --key ./cosign.pub \
  docker.io/tines/tines-app:latest

Verifying images using Docker Content Trust (legacy)

Up until v33.0, we supported verifying by Docker Content Trust.^↗

DOCKER_CONTENT_TRUST=1 docker pull tines/tines-app:latest