'docker trust sign' does not work with manifest lists

I created/pushed a new manifest list (using some LinuxKit images/repo for which signing is already set up:

$ docker manifest create linuxkit/auditd:test-sign \
    linuxkit/auditd:6ea41e1a0c3c0396703aa888f23e5dafcc4fd2bd-arm64 \
    linuxkit/auditd:6ea41e1a0c3c0396703aa888f23e5dafcc4fd2bd-amd64
$ docker manifest push linuxkit/auditd:test-sign

The manifest is available and inspectable.

The, I attempt to sign the manifest list:

$ docker trust sign linuxkit/auditd:test-sign
Error: No such image: linuxkit/auditd:test-sign

@n4ss

cc @n4ss do you know who can look into this?

This doesn't work for two reasons.

checkLocalImageExistence only returns local Images and doesn't check if a manifest is local. If that was modified to be checkLocalExistence for images and manifests it would break in sign.go on line 93 which calls image.TrustedPush.

If a manifest was signed first with notary then multisigning would work with trust sign.
AFAIK there isn't an equivalent to image.TrustedPush for manifests

closing because we removed docker trust from the CLI; remove support for client-side docker content trust validation #6603

Navigation Menu

Repository navigation

'docker trust sign' does not work with manifest lists #910

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

'docker trust sign' does not work with manifest lists #910

Description

Activity

dnephin commented on Feb 28, 2018

eiais commented on Mar 6, 2018

thaJeztah commented on May 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions