Importing a delegation certificate

As a repository owner:

  1. Add the delegation key to the repository using the targets/releases path, as this is what Docker searches for when signing an image (first targets, then targets/releases:

    ❯ notary delegation -D -v -s -d ~/.docker/trust add <aws_account_id> targets/releases delegation.crt --all-paths
    Addition of delegation role targets/releases with keys [e93a68479026f002b9dedb35f563cf5abc50aecd18b2205ad296d3101c0d3c21], with paths ["" <all paths>], to repository "<aws_account_id>" staged for next publish.
  2. Check the unpublished (staged) changes:

    ❯ notary -D -v -s -d ~/.docker/trust status <aws_account_id>
    Unpublished changes for <aws_account_id>
    #    ACTION    SCOPE               TYPE          PATH
    -    ------    -----               ----          ----
    0    create    targets/releases    delegation
    1    create    targets/releases    delegation
  3. Publish the queued changes:

    ❯ notary -v -s -d ~/.docker/trust publish <aws_account_id>
    Pushing changes to <aws_account_id>
    Enter passphrase for targets key with ID 79a6fca:
    Successfully published changes for repository <aws_account_id>

    Enter the previously created targets repository key passphrase.

  4. Confirm the delegation list looks correct:

    ❯ notary -v -s -d ~/.docker/trust delegation list <aws_account_id>
    ROLE                PATHS             KEY IDS                    THRESHOLD
    ----                -----             -------                    ---------
    targets/releases    "" <all paths>    61a6430…                   1

results matching ""

    No results matching ""