+
Skip to content

Docker image verify #1353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Docker image verify #1353

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c185305
docker image verify
May 14, 2025
72a98a2
digest
May 14, 2025
9280b51
fix
May 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion source/mainnet/docs/installation/downloads.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,11 @@ For the system requirements to run a node, see :ref:`System requirements to run

.. dropdown:: Linux-Docker |mainnet-node-version|

To learn how to run a node with Ubuntu, see :ref:`Run a node on a server with Ubuntu <run-node-ubuntu>`. To upgrade your Docker node either restart the service if you are using the `:latest` image tag, or change the image tag to the new version. See :ref:`Running/upgrading a node<running-a-node>` for details.
To learn how to run a node with Docker, see :ref:`Run a node with Docker <run-a-node>`.

To upgrade your Docker node either restart the service if you are using the `:latest` image tag, or change the image tag to the new version. See :ref:`Running/upgrading a node<running-a-node>` for details.

See :ref:`Verify Concordium Node Docker Image<verify-docker-image>` for how the verify the signature on the Docker image.

.. dropdown:: Windows |mainnet-node-version|

Expand Down Expand Up @@ -230,6 +234,8 @@ For the system requirements to run a node, see :ref:`System requirements to run

To upgrade your Docker node either restart the service if you are using the `:latest` image tag, or change the image tag to the new version. See :ref:`Running/upgrading a node<running-a-node>` for details.

See :ref:`Verify Concordium Node Docker Image<verify-docker-image>` for how the verify the signature on the Docker image.

.. dropdown:: Windows |testnet-node-version|

To run a node on Windows, `download a Testnet Windows Installer package <https://distribution.concordium.software/windows/Signed/Node-8.0.3-1.msi>`_. **Please be aware that you should backup your configuration, as the installer will overwrite the current configuration with a standard configuration.**
Expand Down
28 changes: 28 additions & 0 deletions source/mainnet/docs/installation/verification-instructions.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,34 @@ Verification instructions

To find instructions on how to verify the integrity of the file you have downloaded, navigate to the respective section that outlines the steps needed for that specific file.

.. _verify-docker-image:

Verify Concordium Node Docker Image
===================================

The Docker images are signed with Sigstore Cosign. To verify
the signature run ``cosign verify`` with the ``certificate-oidc-issuer`` and ``certificate-identity`` as specified (important):

.. code-block:: console
:substitutions:

$cosign verify concordium/mainnet-node:|mainnet-node-version| \
--certificate-identity=https://github.com/Concordium/concordium-node/.github/workflows/release.yaml@refs/heads/main \
--certificate-oidc-issuer=https://token.actions.githubusercontent.com

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion would be to give the correct output that the reader should expect to be sure the verification worked:
e.g.

The expected output:

Verification for ......................................................... --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

This verifies that the image was build and signed by Concordium. You can replace the image with ``testnet-node`` and the tag with the tag you want to run.

To make sure the image is not modified between you check the signature and you use the image,
you should first get the image hash and then verify and run the image by referencing the hash:

.. code-block:: console
:substitutions:

$crane digest concordium/mainnet-node:|mainnet-node-version|
$cosign verify concordium/mainnet-node@sha256:6a4f8c65345ddea7db82431b76c8eadb09b9d0ebd93d4825870704e878d81f1a \
--certificate-identity=https://github.com/Concordium/concordium-node/.github/workflows/release.yaml@refs/heads/main \
--certificate-oidc-issuer=https://token.actions.githubusercontent.com

Concordium Desktop Wallet
=========================

Expand Down
4 changes: 3 additions & 1 deletion source/mainnet/docs/network/nodes/run-node.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@ Running/upgrading a node
========================

Concordium provides two Docker images, a `mainnet <https://hub.docker.com/r/concordium/mainnet-node>`_ one and a `testnet <https://hub.docker.com/r/concordium/testnet-node>`_ one.
These images are designed to be used together with docker-compose, or a similar driver. This guide provides a sample configuration using ``docker-compose``.
The images are signed with Sigstore Cosign and the signature can be verified by following :ref:`Verify Concordium Node Docker Image<verify-docker-image>`.

The images are designed to be used together with docker-compose, or a similar driver. This guide provides a sample configuration using ``docker-compose``.

The node requires a database which must be stored on the host system so that it persists when the docker container is stopped. It is up to the user to select the location of the database on their host system. In the guide the location used is ``/var/lib/concordium-mainnet`` or ``/var/lib/concordium-testent`` but any location to which the user that runs the Docker command has access to will do.

Expand Down
点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载