toolshed/docker-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #461 from vdemeester/trust-updates

Browse Source 
[18.03] move trust out of experimental
This commit is contained in:
Andrew Hsu
2018-03-14 10:23:54 -07:00
committed by GitHub
parent 70cb53f0ba 093b46e361
commit 7d9137fefc
22 changed files with 269 additions and 277 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/cli/cli/command/trust/cmd.go
+4 -6
View File
@@ -9,14 +9,12 @@ import (
// NewTrustCommand returns a cobra command for `trust` subcommands
func NewTrustCommand(dockerCli command.Cli) *cobra.Command {
cmd := &cobra.Command{
Use: "trust",
Short: "Manage trust on Docker images (experimental)",
Args: cli.NoArgs,
RunE: command.ShowHelp(dockerCli.Err()),
Annotations: map[string]string{"experimentalCLI": ""},
Use: "trust",
Short: "Manage trust on Docker images",
Args: cli.NoArgs,
RunE: command.ShowHelp(dockerCli.Err()),
}
cmd.AddCommand(
newViewCommand(dockerCli),
newRevokeCommand(dockerCli),
newSignCommand(dockerCli),
newTrustKeyCommand(dockerCli),
components/cli/cli/command/trust/inspect.go
+35 -3
View File
@@ -2,6 +2,7 @@ package trust
import (
"encoding/json"
"fmt"
"sort"
"github.com/docker/cli/cli"
@@ -11,24 +12,55 @@ import (
"github.com/theupdateframework/notary/tuf/data"
)
type inspectOptions struct {
remotes []string
// FIXME(n4ss): this is consistent with `docker service inspect` but we should provide
// a `--format` flag too. (format and pretty-print should be exclusive)
prettyPrint bool
}
func newInspectCommand(dockerCli command.Cli) *cobra.Command {
options := inspectOptions{}
cmd := &cobra.Command{
Use: "inspect IMAGE[:TAG] [IMAGE[:TAG]...]",
Short: "Return low-level information about keys and signatures",
Args: cli.RequiresMinArgs(1),
RunE: func(cmd *cobra.Command, args []string) error {
return runInspect(dockerCli, args)
options.remotes = args
return runInspect(dockerCli, options)
},
}
flags := cmd.Flags()
flags.BoolVar(&options.prettyPrint, "pretty", false, "Print the information in a human friendly format")
return cmd
}
func runInspect(dockerCli command.Cli, remotes []string) error {
func runInspect(dockerCli command.Cli, opts inspectOptions) error {
if opts.prettyPrint {
var err error
for index, remote := range opts.remotes {
if err = prettyPrintTrustInfo(dockerCli, remote); err != nil {
return err
}
// Additional separator between the inspection output of each image
if index < len(opts.remotes)-1 {
fmt.Fprint(dockerCli.Out(), "\n\n")
}
}
return err
}
getRefFunc := func(ref string) (interface{}, []byte, error) {
i, err := getRepoTrustInfo(dockerCli, ref)
return nil, i, err
}
return inspect.Inspect(dockerCli.Out(), remotes, "", getRefFunc)
return inspect.Inspect(dockerCli.Out(), opts.remotes, "", getRefFunc)
}
func getRepoTrustInfo(cli command.Cli, remote string) ([]byte, error) {
components/cli/cli/command/trust/view.go → components/cli/cli/command/trust/inspect_pretty.go
+8 -19
View File
@@ -4,34 +4,21 @@ import (
"fmt"
"io"
"sort"
"strings"
"github.com/docker/cli/cli"
"github.com/docker/cli/cli/command"
"github.com/docker/cli/cli/command/formatter"
"github.com/spf13/cobra"
"github.com/theupdateframework/notary/client"
)
func newViewCommand(dockerCli command.Cli) *cobra.Command {
cmd := &cobra.Command{
Use: "view IMAGE[:TAG]",
Short: "Display detailed information about keys and signatures",
Args: cli.ExactArgs(1),
RunE: func(cmd *cobra.Command, args []string) error {
return viewTrustInfo(dockerCli, args[0])
},
}
return cmd
}
func viewTrustInfo(cli command.Cli, remote string) error {
func prettyPrintTrustInfo(cli command.Cli, remote string) error {
signatureRows, adminRolesWithSigs, delegationRoles, err := lookupTrustInfo(cli, remote)
if err != nil {
return err
}
if len(signatureRows) > 0 {
fmt.Fprintf(cli.Out(), "\nSignatures for %s\n\n", remote)
if err := printSignatures(cli.Out(), signatureRows); err != nil {
return err
}
@@ -42,14 +29,14 @@ func viewTrustInfo(cli command.Cli, remote string) error {
// If we do not have additional signers, do not display
if len(signerRoleToKeyIDs) > 0 {
fmt.Fprintf(cli.Out(), "\nList of signers and their keys for %s:\n\n", strings.Split(remote, ":")[0])
fmt.Fprintf(cli.Out(), "\nList of signers and their keys for %s\n\n", remote)
if err := printSignerInfo(cli.Out(), signerRoleToKeyIDs); err != nil {
return err
}
}
// This will always have the root and targets information
fmt.Fprintf(cli.Out(), "\nAdministrative keys for %s:\n", strings.Split(remote, ":")[0])
fmt.Fprintf(cli.Out(), "\nAdministrative keys for %s\n\n", remote)
printSortedAdminKeys(cli.Out(), adminRolesWithSigs)
return nil
}
@@ -57,7 +44,9 @@ func viewTrustInfo(cli command.Cli, remote string) error {
func printSortedAdminKeys(out io.Writer, adminRoles []client.RoleWithSignatures) {
sort.Slice(adminRoles, func(i, j int) bool { return adminRoles[i].Name > adminRoles[j].Name })
for _, adminRole := range adminRoles {
fmt.Fprintf(out, "%s", formatAdminRole(adminRole))
if formattedAdminRole := formatAdminRole(adminRole); formattedAdminRole != "" {
fmt.Fprintf(out, " %s", formattedAdminRole)
}
}
}
components/cli/cli/command/trust/view_test.go → components/cli/cli/command/trust/inspect_pretty_test.go
+39 -31
View File
@@ -16,11 +16,13 @@ import (
"github.com/theupdateframework/notary/tuf/data"
)
// TODO(n4ss): remove common tests with the regular inspect command
type fakeClient struct {
dockerClient.Client
}
func TestTrustViewCommandErrors(t *testing.T) {
func TestTrustInspectPrettyCommandErrors(t *testing.T) {
testCases := []struct {
name string
args []string
@@ -28,12 +30,7 @@ func TestTrustViewCommandErrors(t *testing.T) {
}{
{
name: "not-enough-args",
expectedError: "requires exactly 1 argument",
},
{
name: "too-many-args",
args: []string{"remote1", "remote2"},
expectedError: "requires exactly 1 argument",
expectedError: "requires at least 1 argument",
},
{
name: "sha-reference",
@@ -47,104 +44,115 @@ func TestTrustViewCommandErrors(t *testing.T) {
},
}
for _, tc := range testCases {
cmd := newViewCommand(
cmd := newInspectCommand(
test.NewFakeCli(&fakeClient{}))
cmd.SetArgs(tc.args)
cmd.SetOutput(ioutil.Discard)
cmd.Flags().Set("pretty", "true")
testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
}
}
func TestTrustViewCommandOfflineErrors(t *testing.T) {
func TestTrustInspectPrettyCommandOfflineErrors(t *testing.T) {
cli := test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getOfflineNotaryRepository)
cmd := newViewCommand(cli)
cmd := newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"nonexistent-reg-name.io/image"})
cmd.SetOutput(ioutil.Discard)
testutil.ErrorContains(t, cmd.Execute(), "No signatures or cannot access nonexistent-reg-name.io/image")
cli = test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getOfflineNotaryRepository)
cmd = newViewCommand(cli)
cmd = newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"nonexistent-reg-name.io/image:tag"})
cmd.SetOutput(ioutil.Discard)
testutil.ErrorContains(t, cmd.Execute(), "No signatures or cannot access nonexistent-reg-name.io/image")
}
func TestTrustViewCommandUninitializedErrors(t *testing.T) {
func TestTrustInspectPrettyCommandUninitializedErrors(t *testing.T) {
cli := test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getUninitializedNotaryRepository)
cmd := newViewCommand(cli)
cmd := newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"reg/unsigned-img"})
cmd.SetOutput(ioutil.Discard)
testutil.ErrorContains(t, cmd.Execute(), "No signatures or cannot access reg/unsigned-img")
cli = test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getUninitializedNotaryRepository)
cmd = newViewCommand(cli)
cmd = newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"reg/unsigned-img:tag"})
cmd.SetOutput(ioutil.Discard)
testutil.ErrorContains(t, cmd.Execute(), "No signatures or cannot access reg/unsigned-img:tag")
}
func TestTrustViewCommandEmptyNotaryRepoErrors(t *testing.T) {
func TestTrustInspectPrettyCommandEmptyNotaryRepoErrors(t *testing.T) {
cli := test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getEmptyTargetsNotaryRepository)
cmd := newViewCommand(cli)
cmd := newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"reg/img:unsigned-tag"})
cmd.SetOutput(ioutil.Discard)
assert.NoError(t, cmd.Execute())
assert.Contains(t, cli.OutBuffer().String(), "No signatures for reg/img:unsigned-tag")
assert.Contains(t, cli.OutBuffer().String(), "Administrative keys for reg/img:")
assert.Contains(t, cli.OutBuffer().String(), "Administrative keys for reg/img")
cli = test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getEmptyTargetsNotaryRepository)
cmd = newViewCommand(cli)
cmd = newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"reg/img"})
cmd.SetOutput(ioutil.Discard)
assert.NoError(t, cmd.Execute())
assert.Contains(t, cli.OutBuffer().String(), "No signatures for reg/img")
assert.Contains(t, cli.OutBuffer().String(), "Administrative keys for reg/img:")
assert.Contains(t, cli.OutBuffer().String(), "Administrative keys for reg/img")
}
func TestTrustViewCommandFullRepoWithoutSigners(t *testing.T) {
func TestTrustInspectPrettyCommandFullRepoWithoutSigners(t *testing.T) {
cli := test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getLoadedWithNoSignersNotaryRepository)
cmd := newViewCommand(cli)
cmd := newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"signed-repo"})
assert.NoError(t, cmd.Execute())
golden.Assert(t, cli.OutBuffer().String(), "trust-view-full-repo-no-signers.golden")
golden.Assert(t, cli.OutBuffer().String(), "trust-inspect-pretty-full-repo-no-signers.golden")
}
func TestTrustViewCommandOneTagWithoutSigners(t *testing.T) {
func TestTrustInspectPrettyCommandOneTagWithoutSigners(t *testing.T) {
cli := test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getLoadedWithNoSignersNotaryRepository)
cmd := newViewCommand(cli)
cmd := newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"signed-repo:green"})
assert.NoError(t, cmd.Execute())
golden.Assert(t, cli.OutBuffer().String(), "trust-view-one-tag-no-signers.golden")
golden.Assert(t, cli.OutBuffer().String(), "trust-inspect-pretty-one-tag-no-signers.golden")
}
func TestTrustViewCommandFullRepoWithSigners(t *testing.T) {
func TestTrustInspectPrettyCommandFullRepoWithSigners(t *testing.T) {
cli := test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getLoadedNotaryRepository)
cmd := newViewCommand(cli)
cmd := newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"signed-repo"})
assert.NoError(t, cmd.Execute())
golden.Assert(t, cli.OutBuffer().String(), "trust-view-full-repo-with-signers.golden")
golden.Assert(t, cli.OutBuffer().String(), "trust-inspect-pretty-full-repo-with-signers.golden")
}
func TestTrustViewCommandUnsignedTagInSignedRepo(t *testing.T) {
func TestTrustInspectPrettyCommandUnsignedTagInSignedRepo(t *testing.T) {
cli := test.NewFakeCli(&fakeClient{})
cli.SetNotaryClient(getLoadedNotaryRepository)
cmd := newViewCommand(cli)
cmd := newInspectCommand(cli)
cmd.Flags().Set("pretty", "true")
cmd.SetArgs([]string{"signed-repo:unsigned"})
assert.NoError(t, cmd.Execute())
golden.Assert(t, cli.OutBuffer().String(), "trust-view-unsigned-tag-with-signers.golden")
golden.Assert(t, cli.OutBuffer().String(), "trust-inspect-pretty-unsigned-tag-with-signers.golden")
}
func TestNotaryRoleToSigner(t *testing.T) {
components/cli/cli/command/trust/inspect_test.go
+3 -7
View File
@@ -18,12 +18,7 @@ func TestTrustInspectCommandErrors(t *testing.T) {
}{
{
name: "not-enough-args",
expectedError: "requires exactly 1 argument",
},
{
name: "too-many-args",
args: []string{"remote1", "remote2"},
expectedError: "requires exactly 1 argument",
expectedError: "requires at least 1 argument",
},
{
name: "sha-reference",
@@ -37,8 +32,9 @@ func TestTrustInspectCommandErrors(t *testing.T) {
},
}
for _, tc := range testCases {
cmd := newViewCommand(
cmd := newInspectCommand(
test.NewFakeCli(&fakeClient{}))
cmd.Flags().Set("pretty", "true")
cmd.SetArgs(tc.args)
cmd.SetOutput(ioutil.Discard)
testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
components/cli/cli/command/trust/key.go
+1 -1
View File
@@ -10,7 +10,7 @@ import (
func newTrustKeyCommand(dockerCli command.Streams) *cobra.Command {
cmd := &cobra.Command{
Use: "key",
Short: "Manage keys for signing Docker images (experimental)",
Short: "Manage keys for signing Docker images",
Args: cli.NoArgs,
RunE: command.ShowHelp(dockerCli.Err()),
}
components/cli/cli/command/trust/signer.go
+1 -1
View File
@@ -10,7 +10,7 @@ import (
func newTrustSignerCommand(dockerCli command.Cli) *cobra.Command {
cmd := &cobra.Command{
Use: "signer",
Short: "Manage entities who can sign Docker images (experimental)",
Short: "Manage entities who can sign Docker images",
Args: cli.NoArgs,
RunE: command.ShowHelp(dockerCli.Err()),
}
components/cli/cli/command/trust/testdata/trust-view-full-repo-no-signers.golden → components/cli/cli/command/trust/testdata/trust-inspect-pretty-full-repo-no-signers.golden
Vendored
+7 -3
View File
@@ -1,6 +1,10 @@
Signatures for signed-repo
SIGNED TAG DIGEST SIGNERS
green 677265656e2d646967657374 (Repo Admin)
Administrative keys for signed-repo:
Repository Key: targetsID
Root Key: rootID
Administrative keys for signed-repo
Repository Key: targetsID
Root Key: rootID
components/cli/cli/command/trust/testdata/trust-view-full-repo-with-signers.golden → components/cli/cli/command/trust/testdata/trust-inspect-pretty-full-repo-with-signers.golden
Vendored
+8 -4
View File
@@ -1,14 +1,18 @@
Signatures for signed-repo
SIGNED TAG DIGEST SIGNERS
blue 626c75652d646967657374 alice
green 677265656e2d646967657374 (Repo Admin)
red 7265642d646967657374 alice, bob
List of signers and their keys for signed-repo:
List of signers and their keys for signed-repo
SIGNER KEYS
alice A
bob B
Administrative keys for signed-repo:
Repository Key: targetsID
Root Key: rootID
Administrative keys for signed-repo
Repository Key: targetsID
Root Key: rootID
components/cli/cli/command/trust/testdata/trust-inspect-pretty-one-tag-no-signers.golden
Vendored
+10
View File
@@ -0,0 +1,10 @@
Signatures for signed-repo:green
SIGNED TAG DIGEST SIGNERS
green 677265656e2d646967657374 (Repo Admin)
Administrative keys for signed-repo:green
Repository Key: targetsID
Root Key: rootID
components/cli/cli/command/trust/testdata/trust-inspect-pretty-unsigned-tag-with-signers.golden
Vendored
+14
View File
@@ -0,0 +1,14 @@
No signatures for signed-repo:unsigned
List of signers and their keys for signed-repo:unsigned
SIGNER KEYS
alice A
bob B
Administrative keys for signed-repo:unsigned
Repository Key: targetsID
Root Key: rootID
components/cli/cli/command/trust/testdata/trust-view-one-tag-no-signers.golden
Vendored
-6
View File
@@ -1,6 +0,0 @@
SIGNED TAG DIGEST SIGNERS
green 677265656e2d646967657374 (Repo Admin)
Administrative keys for signed-repo:
Repository Key: targetsID
Root Key: rootID
components/cli/cli/command/trust/testdata/trust-view-unsigned-tag-with-signers.golden
Vendored
-13
View File
@@ -1,13 +0,0 @@
No signatures for signed-repo:unsigned
List of signers and their keys for signed-repo:
SIGNER KEYS
alice A
bob B
Administrative keys for signed-repo:
Repository Key: targetsID
Root Key: rootID
components/cli/contrib/completion/bash/docker
+16 -16
View File
@@ -4713,9 +4713,9 @@ _docker_tag() {
_docker_trust() {
local subcommands="
inspect
revoke
sign
view
"
__docker_subcommands "$subcommands" && return
@@ -4729,6 +4729,20 @@ _docker_trust() {
esac
}
_docker_trust_inspect() {
case "$cur" in
-*)
COMPREPLY=( $( compgen -W "--help --pretty" -- "$cur" ) )
;;
*)
local counter=$(__docker_pos_first_nonflag)
if [ "$cword" -eq "$counter" ]; then
__docker_complete_images --repo --tag
fi
;;
esac
}
_docker_trust_revoke() {
case "$cur" in
-*)
@@ -4757,20 +4771,6 @@ _docker_trust_sign() {
esac
}
_docker_trust_view() {
case "$cur" in
-*)
COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
;;
*)
local counter=$(__docker_pos_first_nonflag)
if [ "$cword" -eq "$counter" ]; then
__docker_complete_images --repo --tag
fi
;;
esac
}
_docker_unpause() {
_docker_container_unpause
@@ -4947,6 +4947,7 @@ _docker() {
stack
swarm
system
trust
volume
)
@@ -4999,7 +5000,6 @@ _docker() {
local experimental_commands=(
checkpoint
deploy
trust
)
local commands=(${management_commands[*]} ${top_level_commands[*]})
components/cli/docs/reference/commandline/trust_inspect.md
+121 -15
View File
@@ -1,7 +1,7 @@
---
title: "trust inspect"
description: "The inspect command description and usage"
keywords: "view, notary, trust"
keywords: "inspect, notary, trust"
---
<!-- This file is maintained within the docker/cli GitHub
@@ -20,6 +20,9 @@ Usage: docker trust inspect IMAGE[:TAG] [IMAGE[:TAG]...]
Return low-level information about keys and signatures
Options:
--help Print usage
--pretty Print the information in a human friendly format
```
## Description
@@ -28,12 +31,6 @@ Return low-level information about keys and signatures
This includes all image tags that are signed, who signed them, and who can sign
new tags.
`docker trust inspect` prints the trust information in a machine-readable format. Refer to
[`docker trust view`](trust_view.md) for a human-friendly output.
`docker trust inspect` is currently experimental.
## Examples
### Get low-level details about signatures for a single image tag
@@ -78,13 +75,13 @@ $ docker trust inspect alpine:latest
]
```
The `SignedTags` key will list the `SignedTag` name, its `Digest`, and the `Signers` responsible for the signature.
The `SignedTags` key will list the `SignedTag` name, its `Digest`,
and the `Signers` responsible for the signature.
`AdministrativeKeys` will list the `Repository` and `Root` keys.
This format mirrors the output of `docker trust view`
If signers are set up for the repository via other `docker trust` commands, `docker trust inspect` includes a `Signers` key:
If signers are set up for the repository via other `docker trust`
commands, `docker trust inspect` includes a `Signers` key:
```bash
$ docker trust inspect my-image:purple
@@ -156,14 +153,16 @@ $ docker trust inspect my-image:purple
]
```
If the image tag is unsigned or unavailable, `docker trust inspect` does not display any signed tags.
If the image tag is unsigned or unavailable, `docker trust inspect` does not
display any signed tags.
```bash
$ docker trust inspect unsigned-img
No signatures or cannot access unsigned-img
```
However, if other tags are signed in the same image repository, `docker trust inspect` reports relevant key information:
However, if other tags are signed in the same image repository,
`docker trust inspect` reports relevant key information:
```bash
$ docker trust inspect alpine:unsigned
@@ -195,7 +194,8 @@ $ docker trust inspect alpine:unsigned
### Get details about signatures for all image tags in a repository
If no tag is specified, `docker trust inspect` will report details for all signed tags in the repository:
If no tag is specified, `docker trust inspect` will report details for all
signed tags in the repository:
```bash
$ docker trust inspect alpine
@@ -258,7 +258,8 @@ $ docker trust inspect alpine
### Get details about signatures for multiple images
`docker trust inspect` can take multiple repositories and images as arguments, and reports the results in an ordered list:
`docker trust inspect` can take multiple repositories and images as arguments,
and reports the results in an ordered list:
```bash
$ docker trust inspect alpine notary
@@ -362,3 +363,108 @@ $ docker trust inspect alpine notary
}
]
```
### Formatting
You can print the inspect output in a human-readable format instead of the default
JSON output, by using the `--pretty` option:
### Get details about signatures for a single image tag
```bash
$ docker trust inspect --pretty alpine:latest
SIGNED TAG DIGEST SIGNERS
latest 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
Administrative keys for alpine:latest:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
```
The `SIGNED TAG` is the signed image tag with a unique content-addressable
`DIGEST`. `SIGNERS` lists all entities who have signed.
The administrative keys listed specify the root key of trust, as well as
the administrative repository key. These keys are responsible for modifying
signers, and rotating keys for the signed repository.
If signers are set up for the repository via other `docker trust` commands,
`docker trust inspect --pretty` displays them appropriately as a `SIGNER`
and specify their `KEYS`:
```bash
$ docker trust inspect --pretty my-image:purple
SIGNED TAG DIGEST SIGNERS
purple 941d3dba358621ce3c41ef67b47cf80f701ff80cdf46b5cc86587eaebfe45557 alice, bob, carol
List of signers and their keys:
SIGNER KEYS
alice 47caae5b3e61, a85aab9d20a4
bob 034370bcbd77, 82a66673242c
carol b6f9f8e1aab0
Administrative keys for my-image:
Repository Key: 27df2c8187e7543345c2e0bf3a1262e0bc63a72754e9a7395eac3f747ec23a44
Root Key: 40b66ccc8b176be8c7d365a17f3e046d1c3494e053dd57cfeacfe2e19c4f8e8f
```
However, if other tags are signed in the same image repository,
`docker trust inspect` reports relevant key information.
```bash
$ docker trust inspect --pretty alpine:unsigned
No signatures for alpine:unsigned
Administrative keys for alpine:unsigned:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
```
### Get details about signatures for all image tags in a repository
```bash
$ docker trust inspect --pretty alpine
SIGNED TAG DIGEST SIGNERS
2.6 9ace551613070689a12857d62c30ef0daa9a376107ec0fff0e34786cedb3399b (Repo Admin)
2.7 9f08005dff552038f0ad2f46b8e65ff3d25641747d3912e3ea8da6785046561a (Repo Admin)
3.1 d9477888b78e8c6392e0be8b2e73f8c67e2894ff9d4b8e467d1488fcceec21c8 (Repo Admin)
3.2 19826d59171c2eb7e90ce52bfd822993bef6a6fe3ae6bb4a49f8c1d0a01e99c7 (Repo Admin)
3.3 8fd4b76819e1e5baac82bd0a3d03abfe3906e034cc5ee32100d12aaaf3956dc7 (Repo Admin)
3.4 833ad81ace8277324f3ca8c91c02bdcf1d13988d8ecf8a3f97ecdd69d0390ce9 (Repo Admin)
3.5 af2a5bd2f8de8fc1ecabf1c76611cdc6a5f1ada1a2bdd7d3816e121b70300308 (Repo Admin)
3.6 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
edge 79d50d15bd7ea48ea00cf3dd343b0e740c1afaa8e899bee475236ef338e1b53b (Repo Admin)
latest 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
Administrative keys for alpine:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
```
Here's an example with signers that are set up by `docker trust` commands:
```bash
$ docker trust inspect --pretty my-image
SIGNED TAG DIGEST SIGNERS
red 852cc04935f930a857b630edc4ed6131e91b22073bcc216698842e44f64d2943 alice
blue f1c38dbaeeb473c36716f6494d803fbfbe9d8a76916f7c0093f227821e378197 alice, bob
green cae8fedc840f90c8057e1c24637d11865743ab1e61a972c1c9da06ec2de9a139 alice, bob
yellow 9cc65fc3126790e683d1b92f307a71f48f75fa7dd47a7b03145a123eaf0b45ba carol
purple 941d3dba358621ce3c41ef67b47cf80f701ff80cdf46b5cc86587eaebfe45557 alice, bob, carol
orange d6c271baa6d271bcc24ef1cbd65abf39123c17d2e83455bdab545a1a9093fc1c alice
List of signers and their keys for my-image:
SIGNER KEYS
alice 47caae5b3e61, a85aab9d20a4
bob 034370bcbd77, 82a66673242c
carol b6f9f8e1aab0
Administrative keys for my-image:
Repository Key: 27df2c8187e7543345c2e0bf3a1262e0bc63a72754e9a7395eac3f747ec23a44
Root Key: 40b66ccc8b176be8c7d365a17f3e046d1c3494e053dd57cfeacfe2e19c4f8e8f
```
components/cli/docs/reference/commandline/trust_key_generate.md
+1 -3
View File
@@ -1,7 +1,7 @@
---
title: "key generate"
description: "The key generate command description and usage"
keywords: "Key, notary, trust"
keywords: "key, notary, trust"
---
<!-- This file is maintained within the docker/cli Github
@@ -30,8 +30,6 @@ Options:
`docker trust key generate` generates a key-pair to be used with signing,
and loads the private key into the local docker trust keystore.
`docker trust key generate` is currently experimental.
## Examples
### Generate a key-pair
components/cli/docs/reference/commandline/trust_key_load.md
+1 -3
View File
@@ -1,7 +1,7 @@
---
title: "key load"
description: "The key load command description and usage"
keywords: "Key, notary, trust"
keywords: "key, notary, trust"
---
<!-- This file is maintained within the docker/cli Github
@@ -29,8 +29,6 @@ Options:
`docker trust key load` adds private keys to the local docker trust keystore. To add a signer to a repository use `docker trust signer add`.
`docker trust key load` is currently experimental.
## Examples
### Load a single private key
components/cli/docs/reference/commandline/trust_revoke.md
-2
View File
@@ -29,8 +29,6 @@ Options:
`docker trust revoke` removes signatures from tags in signed repositories.
`docker trust revoke` is currently experimental.
## Examples
### Revoke signatures from a signed tag
components/cli/docs/reference/commandline/trust_sign.md
-2
View File
@@ -30,8 +30,6 @@ Options:
`docker trust sign` adds signatures to tags to create signed repositories.
`docker trust sign` is currently experimental.
## Examples
### Sign a tag as a repo admin
components/cli/docs/reference/commandline/trust_signer_add.md
-2
View File
@@ -29,8 +29,6 @@ Options:
`docker trust signer add` adds signers to signed repositories.
`docker trust signer add` is currently experimental.
## Examples
### Add a signer to a repo
components/cli/docs/reference/commandline/trust_signer_remove.md
-2
View File
@@ -29,8 +29,6 @@ Options:
`docker trust signer remove` removes signers from signed repositories.
`docker trust signer remove` is currently experimental.
## Examples
### Remove a signer from a repo
components/cli/docs/reference/commandline/trust_view.md
-138
View File
@@ -1,138 +0,0 @@
---
title: "trust view"
description: "The view command description and usage"
keywords: "view, notary, trust"
---
<!-- This file is maintained within the docker/cli GitHub
repository at https://github.com/docker/cli/. Make all
pull requests against that repo. If you see this file in
another repository, consider it read-only there, as it will
periodically be overwritten by the definitive file. Pull
requests which include edits to this file in other repositories
will be rejected.
-->
# trust view
```markdown
Usage: docker trust view IMAGE[:TAG]
Display detailed information about keys and signatures
```
## Description
`docker trust view` provides detailed information on signed repositories.
This includes all image tags that are signed, who signed them, and who can sign
new tags.
By default, `docker trust view` renders results in a table.
`docker trust view` is currently experimental.
## Examples
### Get details about signatures for a single image tag
```bash
$ docker trust view alpine:latest
SIGNED TAG DIGEST SIGNERS
latest 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
Administrative keys for alpine:latest:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
```
The `SIGNED TAG` is the signed image tag with a unique content-addressable `DIGEST`. `SIGNERS` lists all entities who have signed.
The administrative keys listed specify the root key of trust, as well as the administrative repository key. These keys are responsible for modifying signers, and rotating keys for the signed repository.
If signers are set up for the repository via other `docker trust` commands, `docker trust view` displays them appropriately as a `SIGNER` and specify their `KEYS`:
```bash
$ docker trust view my-image:purple
SIGNED TAG DIGEST SIGNERS
purple 941d3dba358621ce3c41ef67b47cf80f701ff80cdf46b5cc86587eaebfe45557 alice, bob, carol
List of signers and their keys:
SIGNER KEYS
alice 47caae5b3e61, a85aab9d20a4
bob 034370bcbd77, 82a66673242c
carol b6f9f8e1aab0
Administrative keys for my-image:
Repository Key: 27df2c8187e7543345c2e0bf3a1262e0bc63a72754e9a7395eac3f747ec23a44
Root Key: 40b66ccc8b176be8c7d365a17f3e046d1c3494e053dd57cfeacfe2e19c4f8e8f
```
If the image tag is unsigned or unavailable, `docker trust view` does not display any signed tags.
```bash
$ docker trust view unsigned-img
No signatures or cannot access unsigned-img
```
However, if other tags are signed in the same image repository, `docker trust view` reports relevant key information.
```bash
$ docker trust view alpine:unsigned
No signatures for alpine:unsigned
Administrative keys for alpine:unsigned:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
```
### Get details about signatures for all image tags in a repository
```bash
$ docker trust view alpine
SIGNED TAG DIGEST SIGNERS
2.6 9ace551613070689a12857d62c30ef0daa9a376107ec0fff0e34786cedb3399b (Repo Admin)
2.7 9f08005dff552038f0ad2f46b8e65ff3d25641747d3912e3ea8da6785046561a (Repo Admin)
3.1 d9477888b78e8c6392e0be8b2e73f8c67e2894ff9d4b8e467d1488fcceec21c8 (Repo Admin)
3.2 19826d59171c2eb7e90ce52bfd822993bef6a6fe3ae6bb4a49f8c1d0a01e99c7 (Repo Admin)
3.3 8fd4b76819e1e5baac82bd0a3d03abfe3906e034cc5ee32100d12aaaf3956dc7 (Repo Admin)
3.4 833ad81ace8277324f3ca8c91c02bdcf1d13988d8ecf8a3f97ecdd69d0390ce9 (Repo Admin)
3.5 af2a5bd2f8de8fc1ecabf1c76611cdc6a5f1ada1a2bdd7d3816e121b70300308 (Repo Admin)
3.6 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
edge 79d50d15bd7ea48ea00cf3dd343b0e740c1afaa8e899bee475236ef338e1b53b (Repo Admin)
latest 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
Administrative keys for alpine:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
```
Here's an example with signers that are set up by `docker trust` commands:
```bash
$ docker trust view my-image
SIGNED TAG DIGEST SIGNERS
red 852cc04935f930a857b630edc4ed6131e91b22073bcc216698842e44f64d2943 alice
blue f1c38dbaeeb473c36716f6494d803fbfbe9d8a76916f7c0093f227821e378197 alice, bob
green cae8fedc840f90c8057e1c24637d11865743ab1e61a972c1c9da06ec2de9a139 alice, bob
yellow 9cc65fc3126790e683d1b92f307a71f48f75fa7dd47a7b03145a123eaf0b45ba carol
purple 941d3dba358621ce3c41ef67b47cf80f701ff80cdf46b5cc86587eaebfe45557 alice, bob, carol
orange d6c271baa6d271bcc24ef1cbd65abf39123c17d2e83455bdab545a1a9093fc1c alice
List of signers and their keys for my-image:
SIGNER KEYS
alice 47caae5b3e61, a85aab9d20a4
bob 034370bcbd77, 82a66673242c
carol b6f9f8e1aab0
Administrative keys for my-image:
Repository Key: 27df2c8187e7543345c2e0bf3a1262e0bc63a72754e9a7395eac3f747ec23a44
Root Key: 40b66ccc8b176be8c7d365a17f3e046d1c3494e053dd57cfeacfe2e19c4f8e8f
```