4:25 p.m.
Hi Scott,
we would like to sign images using an HSM and those provide PKCS#11
(https://www.ibm.com/security/cryptocards/pciecc/overview,
https://www.yubico.com/product/yubihsm-2,
https://www.nitrokey.com/#comparison) and there does not seem to be any
proper connection from that to the OpenPGP world. The only thing I found
might be https://github.com/alonbl/gnupg-pkcs11-scd and that looks also
a bit limited and dated. I'm currently especially interested in a way to
use that IBM crypto card. A relatively easy solution might be to just
store the signature hash in the signature file. To verify that it seem
to be enough to something like "openssl dgst -sha256 -verify public.pem
-signature manifest.sig manifest.json". My understanding so far is that
this is actually a PKCS#1 hash calculation. Anyhow if I could get podman
doing that openssl call instead of openpgp things would be working for me.
regards,
Hendrik
On 11.05.2020 18:38, Scott McCarty wrote:
Hendrik,
That's all that's supported today. Do you have any other tools
you would be looking for?
Best Regards
Scott M
On Wed, May 6, 2020 at 3:15 AM Hendrik Haddorp
<hendrik.haddorp(a)gmx.net <mailto:hendrik.haddorp@gmx.net>> wrote:
Hi,
is OpenPGP the only supported image signing open supported by podman /
skopeo or are there other options? Using OpenGPG works quite fine
for me
so far but in the end we are trying to sign an image using an IBM 4765
crypto card and so far have not figured out how this can play
together.
thanks,
Hendrk
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
<mailto:podman@lists.podman.io>
To unsubscribe send an email to podman-leave(a)lists.podman.io
<mailto:podman-leave@lists.podman.io>
--
--
Moving Wordpress, Mediawiki and Request Tracker into
containers:http://crunchtools.com/a-hackers-guide-to-moving-linux-service...
--
Scott McCarty Product Management - Containers, Red Hat Enterprise
Linux & OpenShift Email: smccarty(a)redhat.com
<mailto:smccarty@redhat.com> Phone: 312-660-3535 Cell: 330-807-1043
Web: http://crunchtools.com
Using Azure Pipelines with Red Hat Universal Base Image and
Quay.io:https://red.ht/2TvYo3Y