Official-images: alpine:v3.5 not signed

[jessfraz]

Right now alpine:v3.5 is tagged as alpine:latest but alpine:v3.5 is not signed and the version of alpine:latest that is synonymous with alpine:v3.5 is also not signed.

Usually this doesn't matter because no one seems to run with content trust on anyways, but the libressl package is in alpine:v3.5 only and I use it and my CI has content trust turned on for my private repo, its been a few weeks and it's still not signed so I'm just going to open an issue :) or I'll turn off content trust for alpine haha <3

[justincormack]

Hmm, which hash is that? I pull alpine with content trust on constantly, including around when you filed the issue... (But its alpine:3.5 not v3.5 but that doesn't exist, but assuming typo in issue not pull)

whale:packages justin$ DOCKER_CONTENT_TRUST=1 docker pull alpine:3.5
Pull (1 of 1): alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Tagging alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 as alpine:3.5
whale:packages justin$ DOCKER_CONTENT_TRUST=1 docker pull alpine:v3.5
No trust data for v3.5
whale:packages justin$ docker pull alpine:v3.5
Error response from daemon: manifest for alpine:v3.5 not found
whale:packages justin$ docker pull alpine:latest
latest: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine:latest
whale:packages justin$ DOCKER_CONTENT_TRUST=1 docker pull alpine:latest
Pull (1 of 1): alpine:latest@sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90
sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90: Pulling from library/alpine
Digest: sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90
Status: Image is up to date for alpine@sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90
Tagging alpine@sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90 as alpine:latest

[justincormack]

Ah yes, there are different hashes there I didn't notice at first

whale:packages justin$ DOCKER_CONTENT_TRUST=1 docker pull alpine:3.5
Pull (1 of 1): alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Tagging alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 as alpine:3.5
whale:packages justin$ 
whale:packages justin$ 
whale:packages justin$ DOCKER_CONTENT_TRUST=1 docker pull alpine:latest
Pull (1 of 1): alpine:latest@sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90
sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90: Pulling from library/alpine
Digest: sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90
Status: Image is up to date for alpine@sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90
Tagging alpine@sha256:a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90 as alpine:latest
whale:packages justin$ 
whale:packages justin$ docker pull alpine:latest
latest: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Downloaded newer image for alpine:latest
whale:packages justin$ docker pull alpine:3.5
3.5: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine:3.5

So sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 appears to be signed as 3.5 but not as latest?

[riyazdf]

Checking notary signatures: latest and 3.4 have the same signed digest. 3.5 has a different digest (which is the same as latest without content trust):
🐳 $ notary -s https://notary.docker.io list docker.io/library/alpine NAME DIGEST SIZE (BYTES) ROLE ---- ------ ------------ ---- 2.6 e9cec9aec697d8b9d450edd32860ecd363f2f3174c8338beb5f809422d182c63 1374 targets 2.7 9f08005dff552038f0ad2f46b8e65ff3d25641747d3912e3ea8da6785046561a 1374 targets 3.1 d83ac2d026c6ef849b9636acaf6f1dcee587bfe343d66dc1de9b65bfbc83022b 528 targets 3.2 e07a4f078d955e32be7c6218053daaa1a2593527671058c512ceed6b4d6d788f 528 targets 3.3 925991fda395a81dd67f22f7d740c117fbff1bcca8ce3d4b40697263b5a11557 528 targets 3.4 a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90 528 targets 3.5 dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 528 targets edge 3129b91dd67b7d690f827655cb90006ce6a526477ad1ce7a4961b0bf1c7bbb68 528 targets latest a4104316f43c73146f1c0af4747d88047a808e58238bcad6506a7fbbf3b30b90 528 targets

@toli do you have any insight into why this might be?

[toli]

I'll look into the details more to make sure this doesn't happen again.

in the meantime, i've issued a call to sign alpine:latest manually and i believe the SHAs match now, it's dfbd4a3a8ebca874

🐳 DOCKER_CONTENT_TRUST=1 docker pull alpine:3.5
Pull (1 of 1): alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Tagging alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 as alpine:3.5

🐳 DOCKER_CONTENT_TRUST=1 docker pull alpine:latest
Pull (1 of 1): alpine:latest@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Tagging alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 as alpine:latest

And confirmation via notary:

 notary -s https://notary.docker.io list docker.io/library/alpine
NAME      DIGEST                                                              SIZE (BYTES)    ROLE
----      ------                                                              ------------    ----
<snip>
3.5       dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8    528             targets
edge      3129b91dd67b7d690f827655cb90006ce6a526477ad1ce7a4961b0bf1c7bbb68    528             targets
latest    dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8    528             targets

[jessfraz]

You the bomb thanks!!!

On Mon, Jan 16, 2017, 09:19 Toli Kuznets [e-mail] wrote:

I'll look into the details more to make sure this doesn't happen again.

in the meantime, i've issued a call to sign alpine:latest manually and i
believe the SHAs match now, it's dfbd4a3a8ebca874

🐳 DOCKER_CONTENT_TRUST=1 docker pull alpine:3.5
Pull (1 of 1): alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Tagging alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 as alpine:3.5

🐳 DOCKER_CONTENT_TRUST=1 docker pull alpine:latest
Pull (1 of 1): alpine:latest@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8: Pulling from library/alpine
Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Image is up to date for alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Tagging alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 as alpine:latest

—
You are receiving this because you authored the thread.

Reply to this email directly, view it on GitHub
https://github.com/docker-library/official-images/issues/2537#issuecomment-272919406,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABYNbGm_8CHzvO5BvyvUF2oBmWM12Lblks5rS6a-gaJpZM4LkCKF
.

[jessfraz]

I believe something is wrong with this image again:

jessfraz@goose ~ $ docker pull alpine:latest
latest: Pulling from library/alpine

Digest: sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
Status: Downloaded newer image for alpine:latest
jessfraz@goose ~ $ export DOCKER_CONTENT_TRUST=1
jessfraz@goose ~ $ docker pull alpine:latest
Pull (1 of 1): alpine:latest@sha256:3952dc48dcc4136ccdde37fbef7e250346538a55a0366e3fccc683336377e372
Error response from daemon: manifest unknown: manifest unknown

[jessfraz]

ping @toli ^

[toli]

ugh.. apologies again, we clearly can't build an automatic verifier fast enough.

i signed alpine:latest and the SHAs match again:

3.5                dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8  
latest             dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 

[jessfraz]

thanks!!

On Sat, Feb 11, 2017 at 4:35 PM, Toli Kuznets [e-mail]
wrote:

ugh.. apologies again, we clearly can't build an automatic verifier fast
enough.

i signed alpine:latest and the SHAs match again:

3.5 dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 528 targets
latest dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8 528

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/docker-library/official-images/issues/2537#issuecomment-279186928,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABYNbHpceb2V4ollDYdp8KT2HgfJ198Zks5rblPMgaJpZM4LkCKF
.

--

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3