So far, we have learned about the different roles and the metadata information that will be used to validate and trust image content. Let's look at a quick summary before getting into the Docker signing action:
- The root key will validate other keys. It signs the root.json file, which contains the list of IDs of the root, targets, snapshot, and timestamp public keys. To verify content signatures, the Docker client will use these public keys. The root key is offline and must be kept safe. The owner of a collection of images should maintain this key. Don't lose this key. You can recreate it, but all your signed images will be invalid.
- The target key signs the targets.json file, which contains a list of your content filenames, along with their sizes and hashes. This file is used to delegate trust to other users in a team so that others can sign the same repository. This key is held by administrators and owners of a collection (repository).
- The delegation key is used...