From 64b258ff4492888355c8c25a860ddc55fa782d67 Mon Sep 17 00:00:00 2001 From: Dmitry Savintsev Date: Tue, 6 Feb 2024 18:34:35 +0100 Subject: [PATCH] document `--ca-roots` and `--ca-intermediates` flags for 'cosign verify' (#291) * document --ca-roots flag for 'cosign verify' Related to https://github.com/sigstore/cosign/issues/3462. Document the new 'cosign verify' --ca-roots flag and its difference to the --certificate-chain flag. List the supported and currently unsupported use cases (single/multiple CA(s), intermediate CAs). Signed-off-by: Dmitry S * add docs on --ca-intermediates for 'cosign verify' Signed-off-by: Dmitry S --------- Signed-off-by: Dmitry S --- content/en/verifying/verify.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/content/en/verifying/verify.md b/content/en/verifying/verify.md index ff0ba9a6..442d3f83 100644 --- a/content/en/verifying/verify.md +++ b/content/en/verifying/verify.md @@ -80,12 +80,22 @@ $ cosign verify --certificate cosign.crt --certificate-chain chain.crt user/demo ``` ## Verify image with user-provided trusted chain -Verify image with the provided certificate chain and identity parameters (intended for -a "bring your own PKI" use case): - +Verify image with the provided certificate chain(s) and identity parameters (intended for +"bring your own PKI" use cases). +* with a single certificate chain file - which may contain one or several intermediate +certificates followed by the root CA certificate - use the `--certificate-chain` parameter: ```shell $ cosign verify --certificate-chain chain.crt --certificate-oidc-issuer https://issuer.example.com --certificate-identity foo@example.com user/demo ``` +* with a certificate bundle PEM file containing several CA roots and (optionally) +intermediate certificates, use the `--ca-roots` parameter together with `--ca-intermediates`: +```shell +$ cosign verify --ca-roots ca-roots.pem --ca-intermediates ca-intermediates \ + --certificate-oidc-issuer https://issuer.example.com \ + --certificate-identity foo@example.com user/demo +``` + +The `--ca-roots` and `--ca-intermediates` flags are mutually exclusive with `--certificate-chain`. ## Verify an image on the transparency log