1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
|
<h1>docker trust inspect</h1> <p><br></p> <p>Return low-level information about keys and signatures</p> <h2 id="usage">Usage</h2> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect IMAGE[:TAG] [IMAGE[:TAG]...]
</pre></div> <p>Refer to the <a href="#options">options section</a> for an overview of available <a href="#options"><code class="language-plaintext highlighter-rouge">OPTIONS</code></a> for this command.</p> <h2 id="description">Description</h2> <p name="extended-description"><code class="language-plaintext highlighter-rouge">docker trust inspect</code> provides low-level JSON information on signed repositories. This includes all image tags that are signed, who signed them, and who can sign new tags.</p> <p>For example uses of this command, refer to the <a href="#examples">examples section</a> below.</p> <h2 id="options">Options</h2> <table> <thead> <tr> <td>Name, shorthand</td> <td>Default</td> <td>Description</td> </tr> </thead> <tbody> <tr> <td><code class="language-plaintext highlighter-rouge">--pretty</code></td> <td></td> <td>Print the information in a human friendly format</td> </tr> </tbody> </table> <h2 id="examples">Examples</h2> <h3 id="get-low-level-details-about-signatures-for-a-single-image-tag">Get low-level details about signatures for a single image tag</h3> <p>Use the <code class="language-plaintext highlighter-rouge">docker trust inspect</code> to get trust information about an image. The following example prints trust information for the <code class="language-plaintext highlighter-rouge">alpine:latest</code> image:</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect alpine:latest
</pre></div> <p>The output is in JSON format, for example:</p> <div class="highlight"><pre class="highlight" data-language="">[
{
"Name": "alpine:latest",
"SignedTags": [
{
"SignedTag": "latest",
"Digest": "d6bfc3baf615dc9618209a8d607ba2a8103d9c8a405b3bd8741d88b4bef36478",
"Signers": [
"Repo Admin"
]
}
],
"Signers": [],
"AdministrativeKeys": [
{
"Name": "Repository",
"Keys": [
{
"ID": "5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd"
}
]
},
{
"Name": "Root",
"Keys": [
{
"ID": "a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce"
}
]
}
]
}
]
</pre></div> <p>The <code class="language-plaintext highlighter-rouge">SignedTags</code> key will list the <code class="language-plaintext highlighter-rouge">SignedTag</code> name, its <code class="language-plaintext highlighter-rouge">Digest</code>, and the <code class="language-plaintext highlighter-rouge">Signers</code> responsible for the signature.</p> <p><code class="language-plaintext highlighter-rouge">AdministrativeKeys</code> will list the <code class="language-plaintext highlighter-rouge">Repository</code> and <code class="language-plaintext highlighter-rouge">Root</code> keys.</p> <p>If signers are set up for the repository via other <code class="language-plaintext highlighter-rouge">docker trust</code> commands, <code class="language-plaintext highlighter-rouge">docker trust inspect</code> includes a <code class="language-plaintext highlighter-rouge">Signers</code> key:</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect my-image:purple
</pre></div> <p>The output is in JSON format, for example:</p> <div class="highlight"><pre class="highlight" data-language="">[
{
"Name": "my-image:purple",
"SignedTags": [
{
"SignedTag": "purple",
"Digest": "941d3dba358621ce3c41ef67b47cf80f701ff80cdf46b5cc86587eaebfe45557",
"Signers": [
"alice",
"bob",
"carol"
]
}
],
"Signers": [
{
"Name": "alice",
"Keys": [
{
"ID": "04dd031411ed671ae1e12f47ddc8646d98f135090b01e54c3561e843084484a3"
},
{
"ID": "6a11e4898a4014d400332ab0e096308c844584ff70943cdd1d6628d577f45fd8"
}
]
},
{
"Name": "bob",
"Keys": [
{
"ID": "433e245c656ae9733cdcc504bfa560f90950104442c4528c9616daa45824ccba"
}
]
},
{
"Name": "carol",
"Keys": [
{
"ID": "d32fa8b5ca08273a2880f455fcb318da3dc80aeae1a30610815140deef8f30d9"
},
{
"ID": "9a8bbec6ba2af88a5fad6047d428d17e6d05dbdd03d15b4fc8a9a0e8049cd606"
}
]
}
],
"AdministrativeKeys": [
{
"Name": "Repository",
"Keys": [
{
"ID": "27df2c8187e7543345c2e0bf3a1262e0bc63a72754e9a7395eac3f747ec23a44"
}
]
},
{
"Name": "Root",
"Keys": [
{
"ID": "40b66ccc8b176be8c7d365a17f3e046d1c3494e053dd57cfeacfe2e19c4f8e8f"
}
]
}
]
}
]
</pre></div> <p>If the image tag is unsigned or unavailable, <code class="language-plaintext highlighter-rouge">docker trust inspect</code> does not display any signed tags.</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect unsigned-img
No signatures or cannot access unsigned-img
</pre></div> <p>However, if other tags are signed in the same image repository, <code class="language-plaintext highlighter-rouge">docker trust inspect</code> reports relevant key information:</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect alpine:unsigned
</pre></div> <p>The output is in JSON format, for example:</p> <div class="highlight"><pre class="highlight" data-language="">[
{
"Name": "alpine:unsigned",
"Signers": [],
"AdministrativeKeys": [
{
"Name": "Repository",
"Keys": [
{
"ID": "5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd"
}
]
},
{
"Name": "Root",
"Keys": [
{
"ID": "a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce"
}
]
}
]
}
]
</pre></div> <h3 id="get-details-about-signatures-for-all-image-tags-in-a-repository">Get details about signatures for all image tags in a repository</h3> <p>If no tag is specified, <code class="language-plaintext highlighter-rouge">docker trust inspect</code> will report details for all signed tags in the repository:</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect alpine
</pre></div> <p>The output is in JSON format, for example:</p> <div class="highlight"><pre class="highlight" data-language="">[
{
"Name": "alpine",
"SignedTags": [
{
"SignedTag": "3.5",
"Digest": "b007a354427e1880de9cdba533e8e57382b7f2853a68a478a17d447b302c219c",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "3.6",
"Digest": "d6bfc3baf615dc9618209a8d607ba2a8103d9c8a405b3bd8741d88b4bef36478",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "edge",
"Digest": "23e7d843e63a3eee29b6b8cfcd10e23dd1ef28f47251a985606a31040bf8e096",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "latest",
"Digest": "d6bfc3baf615dc9618209a8d607ba2a8103d9c8a405b3bd8741d88b4bef36478",
"Signers": [
"Repo Admin"
]
}
],
"Signers": [],
"AdministrativeKeys": [
{
"Name": "Repository",
"Keys": [
{
"ID": "5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd"
}
]
},
{
"Name": "Root",
"Keys": [
{
"ID": "a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce"
}
]
}
]
}
]
</pre></div> <h3 id="get-details-about-signatures-for-multiple-images">Get details about signatures for multiple images</h3> <p><code class="language-plaintext highlighter-rouge">docker trust inspect</code> can take multiple repositories and images as arguments, and reports the results in an ordered list:</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect alpine notary
</pre></div> <p>The output is in JSON format, for example:</p> <div class="highlight"><pre class="highlight" data-language="">[
{
"Name": "alpine",
"SignedTags": [
{
"SignedTag": "3.5",
"Digest": "b007a354427e1880de9cdba533e8e57382b7f2853a68a478a17d447b302c219c",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "3.6",
"Digest": "d6bfc3baf615dc9618209a8d607ba2a8103d9c8a405b3bd8741d88b4bef36478",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "edge",
"Digest": "23e7d843e63a3eee29b6b8cfcd10e23dd1ef28f47251a985606a31040bf8e096",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "integ-test-base",
"Digest": "3952dc48dcc4136ccdde37fbef7e250346538a55a0366e3fccc683336377e372",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "latest",
"Digest": "d6bfc3baf615dc9618209a8d607ba2a8103d9c8a405b3bd8741d88b4bef36478",
"Signers": [
"Repo Admin"
]
}
],
"Signers": [],
"AdministrativeKeys": [
{
"Name": "Repository",
"Keys": [
{
"ID": "5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd"
}
]
},
{
"Name": "Root",
"Keys": [
{
"ID": "a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce"
}
]
}
]
},
{
"Name": "notary",
"SignedTags": [
{
"SignedTag": "server",
"Digest": "71f64ab718a3331dee103bc5afc6bc492914738ce37c2d2f127a8133714ecf5c",
"Signers": [
"Repo Admin"
]
},
{
"SignedTag": "signer",
"Digest": "a6122d79b1e74f70b5dd933b18a6d1f99329a4728011079f06b245205f158fe8",
"Signers": [
"Repo Admin"
]
}
],
"Signers": [],
"AdministrativeKeys": [
{
"Name": "Root",
"Keys": [
{
"ID": "8cdcdef5bd039f4ab5a029126951b5985eebf57cabdcdc4d21f5b3be8bb4ce92"
}
]
},
{
"Name": "Repository",
"Keys": [
{
"ID": "85bfd031017722f950d480a721f845a2944db26a3dc084040a70f1b0d9bbb3df"
}
]
}
]
}
]
</pre></div> <h3 id="formatting">Formatting</h3> <p>You can print the inspect output in a human-readable format instead of the default JSON output, by using the <code class="language-plaintext highlighter-rouge">--pretty</code> option:</p> <h3 id="get-details-about-signatures-for-a-single-image-tag">Get details about signatures for a single image tag</h3> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect --pretty alpine:latest
SIGNED TAG DIGEST SIGNERS
latest 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
Administrative keys for alpine:latest:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
</pre></div> <p>The <code class="language-plaintext highlighter-rouge">SIGNED TAG</code> is the signed image tag with a unique content-addressable <code class="language-plaintext highlighter-rouge">DIGEST</code>. <code class="language-plaintext highlighter-rouge">SIGNERS</code> lists all entities who have signed.</p> <p>The administrative keys listed specify the root key of trust, as well as the administrative repository key. These keys are responsible for modifying signers, and rotating keys for the signed repository.</p> <p>If signers are set up for the repository via other <code class="language-plaintext highlighter-rouge">docker trust</code> commands, <code class="language-plaintext highlighter-rouge">docker trust inspect --pretty</code> displays them appropriately as a <code class="language-plaintext highlighter-rouge">SIGNER</code> and specify their <code class="language-plaintext highlighter-rouge">KEYS</code>:</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect --pretty my-image:purple
SIGNED TAG DIGEST SIGNERS
purple 941d3dba358621ce3c41ef67b47cf80f701ff80cdf46b5cc86587eaebfe45557 alice, bob, carol
List of signers and their keys:
SIGNER KEYS
alice 47caae5b3e61, a85aab9d20a4
bob 034370bcbd77, 82a66673242c
carol b6f9f8e1aab0
Administrative keys for my-image:
Repository Key: 27df2c8187e7543345c2e0bf3a1262e0bc63a72754e9a7395eac3f747ec23a44
Root Key: 40b66ccc8b176be8c7d365a17f3e046d1c3494e053dd57cfeacfe2e19c4f8e8f
</pre></div> <p>However, if other tags are signed in the same image repository, <code class="language-plaintext highlighter-rouge">docker trust inspect</code> reports relevant key information.</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect --pretty alpine:unsigned
No signatures for alpine:unsigned
Administrative keys for alpine:unsigned:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
</pre></div> <h3 id="get-details-about-signatures-for-all-image-tags-in-a-repository-1">Get details about signatures for all image tags in a repository</h3> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect --pretty alpine
SIGNED TAG DIGEST SIGNERS
2.6 9ace551613070689a12857d62c30ef0daa9a376107ec0fff0e34786cedb3399b (Repo Admin)
2.7 9f08005dff552038f0ad2f46b8e65ff3d25641747d3912e3ea8da6785046561a (Repo Admin)
3.1 d9477888b78e8c6392e0be8b2e73f8c67e2894ff9d4b8e467d1488fcceec21c8 (Repo Admin)
3.2 19826d59171c2eb7e90ce52bfd822993bef6a6fe3ae6bb4a49f8c1d0a01e99c7 (Repo Admin)
3.3 8fd4b76819e1e5baac82bd0a3d03abfe3906e034cc5ee32100d12aaaf3956dc7 (Repo Admin)
3.4 833ad81ace8277324f3ca8c91c02bdcf1d13988d8ecf8a3f97ecdd69d0390ce9 (Repo Admin)
3.5 af2a5bd2f8de8fc1ecabf1c76611cdc6a5f1ada1a2bdd7d3816e121b70300308 (Repo Admin)
3.6 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
edge 79d50d15bd7ea48ea00cf3dd343b0e740c1afaa8e899bee475236ef338e1b53b (Repo Admin)
latest 1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe (Repo Admin)
Administrative keys for alpine:
Repository Key: 5a46c9aaa82ff150bb7305a2d17d0c521c2d784246807b2dc611f436a69041fd
Root Key: a2489bcac7a79aa67b19b96c4a3bf0c675ffdf00c6d2fabe1a5df1115e80adce
</pre></div> <p>Here’s an example with signers that are set up by <code class="language-plaintext highlighter-rouge">docker trust</code> commands:</p> <div class="highlight"><pre class="highlight" data-language="">$ docker trust inspect --pretty my-image
SIGNED TAG DIGEST SIGNERS
red 852cc04935f930a857b630edc4ed6131e91b22073bcc216698842e44f64d2943 alice
blue f1c38dbaeeb473c36716f6494d803fbfbe9d8a76916f7c0093f227821e378197 alice, bob
green cae8fedc840f90c8057e1c24637d11865743ab1e61a972c1c9da06ec2de9a139 alice, bob
yellow 9cc65fc3126790e683d1b92f307a71f48f75fa7dd47a7b03145a123eaf0b45ba carol
purple 941d3dba358621ce3c41ef67b47cf80f701ff80cdf46b5cc86587eaebfe45557 alice, bob, carol
orange d6c271baa6d271bcc24ef1cbd65abf39123c17d2e83455bdab545a1a9093fc1c alice
List of signers and their keys for my-image:
SIGNER KEYS
alice 47caae5b3e61, a85aab9d20a4
bob 034370bcbd77, 82a66673242c
carol b6f9f8e1aab0
Administrative keys for my-image:
Repository Key: 27df2c8187e7543345c2e0bf3a1262e0bc63a72754e9a7395eac3f747ec23a44
Root Key: 40b66ccc8b176be8c7d365a17f3e046d1c3494e053dd57cfeacfe2e19c4f8e8f
</pre></div> <h2 id="parent-command">Parent command</h2> <table> <thead> <tr> <th style="text-align: left">Command</th> <th style="text-align: left">Description</th> </tr> </thead> <tbody> <tr> <td style="text-align: left"><a href="../trust/index">docker trust</a></td> <td style="text-align: left">Manage trust on Docker images</td> </tr> </tbody> </table> <h2 id="related-commands">Related commands</h2> <table> <thead> <tr> <td>Command</td> <td>Description</td> </tr> </thead> <tbody> <tr> <td><a href="index">docker trust inspect</a></td> <td>Return low-level information about keys and signatures</td> </tr> <tr> <td><a href="../trust_key/index">docker trust key</a></td> <td>Manage keys for signing Docker images</td> </tr> <tr> <td><a href="../trust_revoke/index">docker trust revoke</a></td> <td>Remove trust for an image</td> </tr> <tr> <td><a href="../trust_sign/index">docker trust sign</a></td> <td>Sign an image</td> </tr> <tr> <td><a href="../trust_signer/index">docker trust signer</a></td> <td>Manage entities who can sign Docker images</td> </tr> </tbody> </table> <div class="_attribution">
<p class="_attribution-p">
© 2019 Docker, Inc.<br>Licensed under the Apache License, Version 2.0.<br>Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. in the United States and/or other countries.<br>Docker, Inc. and other parties may also have trademark rights in other terms used herein.<br>
<a href="https://docs.docker.com/engine/reference/commandline/trust_inspect/" class="_attribution-link">https://docs.docker.com/engine/reference/commandline/trust_inspect/</a>
</p>
</div>
|
