Skip to content

How to check the Cosign signature of the Docker images

In order to verify the signature of SquashTM Docker images, you will need to:

  • install Cosign (see their installation documentation) or use their Docker Hardened Image dhi.io/cosign.
  • run the following command: 
    cosign verify \
  --certificate-identity-regexp="^<PROJECT_URL>" \
  --certificate-oidc-issuer="https://gitlab.com" \
  "<IMAGE_NAME>@sha256:<IMAGE_DIGEST>"
    where
    • <PROJECT_URL> is the URL of the project (see table below)
    • <IMAGE_NAME> is the name of the image
    • <IMAGE_DIGEST> is the SHA256 digest of the image

For example, to verify squashtest/squash:nightly, perform the following commands (note that, if you want to reproduce this on your end, this nightly image is updated daily, so its SHA256 digest changes every day):

docker pull dhi.io/cosign:3
docker run --rm dhi.io/cosign:3 verify \
  --certificate-identity-regexp="^https://gitlab.com/henixdevelopment/squash/squash-tm/core/docker-squash-tm/" \
  --certificate-oidc-issuer="https://gitlab.com" \
  "squashtest/squash:nightly@sha256:aa0b95e031041dc776b48ca94770cea18b4ffaddf1ae34457eb92fd5bcf530f6"

This should display:

Verification for index.docker.io/squashtest/squash@sha256:aa0b95e031041dc776b48ca94770cea18b4ffaddf1ae34457eb92fd5bcf530f6 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":{"identity":{"docker-reference":"index.docker.io/squashtest/squash@sha256:aa0b95e031041dc776b48ca94770cea18b4ffaddf1ae34457eb92fd5bcf530f6"},"image":{"docker-manifest-digest":"sha256:aa0b95e031041dc776b48ca94770cea18b4ffaddf1ae34457eb92fd5bcf530f6"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":{}}]

The list of Docker images produced by the SquashTM project is:

ImageContentDocker image URLProject URL
squashtest/squashSquashTMhttps://hub.docker.com/r/squashtest/squashhttps://gitlab.com/henixdevelopment/squash/squash-tm/core/docker-squash-tm/
squashtest/squash-orchestratorSquashTM Orchestratorhttps://hub.docker.com/r/squashtest/squash-orchestratorhttps://gitlab.com/henixdevelopment/squash/squash-autom-devops/squash-orchestrator/
opentestfactory/maven-runnerExecution environment to run Cucumber and JUnit testshttps://hub.docker.com/r/opentestfactory/maven-runnerhttps://gitlab.com/henixdevelopment/open-source/opentestfactory/test-environments/maven_environment/
opentestfactory/robot-framework-runnerExecution environment to run Robot Framework testshttps://hub.docker.com/r/opentestfactory/robot-framework-runnerhttps://gitlab.com/henixdevelopment/open-source/opentestfactory/test-environments/robotframework_environment/
opentestfactory/allinone†OpenTestFactory Orchestratorhttps://hub.docker.com/r/opentestfactory/allinone/https://gitlab.com/henixdevelopment/open-source/opentestfactory/images/otf-all-in-one-images/

† This is the orchestrator on which SquashTM Orchestrator is based. It is listed here for completeness, but you should not have to install it unless you want to contribute to the open-source OpenTestFactory project.