Skip to content

Commit

Permalink
fix call-out boxes
Browse files Browse the repository at this point in the history
  • Loading branch information
caroldelwing committed Jan 9, 2024
1 parent dd4e41d commit 8ddf65a
Showing 1 changed file with 4 additions and 11 deletions.
15 changes: 4 additions & 11 deletions docs/image-verification.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,8 @@
The Tutorials container image is signed using [Sigstore's](https://sigstore.dev/) Cosign. The container image is signed using a cryptographic key pair that is private and stored internally. The public key is available in the official Spectro Cloud documentation repository at [**static/cosign.pub**](https://raw.githubusercontent.com/spectrocloud/librarium/master/static/cosign.pub). Use the public key to verify the authenticity of the container image. You can learn more about the container image signing process by reviewing the [Signing Containers](https://docs.sigstore.dev/signing/signing_with_containers) documentation page.


:::info

Cosign generates a key pair that uses the ECDSA-P256 algorithm for the signature and SHA256 for hashes. The keys are stored in PEM-encoded PKCS8 format.

:::
> [!NOTE]
> Cosign generates a key pair that uses the ECDSA-P256 algorithm for the signature and SHA256 for hashes. The keys are stored in PEM-encoded PKCS8 format.

Use the following command to verify the authenticity of the container image. Replace the image tag with the version you want to verify.
Expand Down Expand Up @@ -55,12 +52,8 @@ The following checks were performed on each of these signatures:
]
```


:::danger

Do not use the container image if the authenticity cannot be verified. Verify you downloaded the correct public key and that the container image is from `ghcr.io/spectrocloud/tutorials`.

:::
> [!CAUTION]
> Do not use the container image if the authenticity cannot be verified. Verify you downloaded the correct public key and that the container image is from `ghcr.io/spectrocloud/tutorials`.
If the container image is not valid, an error is displayed. The following example shows an error when the container image is not valid.

Expand Down

0 comments on commit 8ddf65a

Please sign in to comment.