Signing Mirrored Images with a Customer Key

You can sign mirrored images with a customer key. SCM uses Cosign to sign and verify mirrored image digests in the container registry. SCM supports Cosign-native keys and unencrypted RSA or ECDSA PEM private keys with matching public keys. SCM imports RSA or ECDSA PEM keys into Cosign format.

By default, customer image signing is optional.

If you omit customer_signing and no customer signing profile exists, SCM:

• Verifies Oracle-signed source images before mirroring.
• Mirrors the images to the destination registry.
• Does not sign the mirrored images with a customer key.
• Does not enforce customer-signature verification during later environment creation.

If you omit customer_signing and a customer signing profile already exists, SCM reuses the existing profile. If the profile has customer signing enabled, SCM continues to use customer signing.

Example: Mirror Images Without Customer Signing

You can use the following payload when you want SCM to mirror images without signing the mirrored images with a customer key:

{
    "destination_registry": {
        "registry_url": "{customer-registry}",
        "registry_user": "{registry-user}",
        "registry_password": "{registry-password}",
        "registry_prefix": "{registry-prefix}"
    },
    "update_global_config": "true",
    "customer_signing": {
        "enabled": false
    }
}

When customer signing is disabled, SCM verifies Oracle source images before mirroring but does not sign the mirrored registry images with a customer key.

Example: Mirror Images with Customer Signing

To sign mirrored images with a customer key:

1. Copy the customer signing files to the SCM container:

   /home/opc/config/image_trust/customer-cosign.key
   /home/opc/config/image_trust/customer-cosign.pub

2. Call the mirror API with customer signing enabled:

   {
       "destination_registry": {
           "registry_url": "<customer registry URL>",
           "registry_user": "<registry user>",
           "registry_password": "<registry password>",
           "registry_prefix": "<registry prefix>"
       },
       "update_global_config": "true",
       "customer_signing": {
           "enabled": true,
           "private_key_path": "/home/opc/config/image_trust/customer-cosign.key",
           "public_key_path": "/home/opc/config/image_trust/customer-cosign.pub",
           "private_key_password": "<signing key password>"
       }
   }

SCM signs the mirrored destination images and creates the following manifest:

/home/opc/config/image_trust/mirror-image-manifest.yaml

SCM uses this manifest and the customer public key during Siebel CRM environment creation.