{"id":7745766,"name":"sudo-bot/action-docker-sign","ecosystem":"actions","description":"Sign docker images","homepage":"","licenses":"mpl-2.0","normalized_licenses":["MPL-2.0"],"repository_url":"https://github.com/sudo-bot/action-docker-sign","keywords_array":["dct","docker","docker-notary","docker-registry","docker-signatures","github-actions","security","signing"],"namespace":"sudo-bot","versions_count":1,"first_release_published_at":"2021-06-02T23:14:39.000Z","latest_release_published_at":"2021-06-02T23:14:39.000Z","latest_release_number":"latest","last_synced_at":"2026-07-31T15:15:32.029Z","created_at":"2023-05-17T10:18:25.526Z","updated_at":"2026-07-31T15:15:32.029Z","registry_url":"https://github.com/sudo-bot/action-docker-sign","install_command":null,"documentation_url":null,"metadata":{"name":"docker-sign","description":"Sign docker images","inputs":{"image-ref":{"description":"The Docker image ref, example: \u003cimagename\u003e:\u003ctag\u003e","required":true},"private-key-id":{"description":"The Docker private key id (hash)","required":true},"private-key":{"description":"The Docker private key","required":true},"private-key-passphrase":{"description":"The Docker private key passphrase","required":true},"private-key-name":{"description":"The Docker private key name","required":false},"sign-manifest":{"description":"Use docker notary and sign the manifest","required":false,"default":"false"},"notary-server":{"description":"The URL to the notary server","required":false,"default":"https://notary.docker.io"},"notary-auth":{"description":"The credentials in auth basic format","required":false}},"branding":{"icon":"feather","color":"gray-dark"},"runs":{"using":"composite","steps":[{"name":"Create the trust keys folder","run":"mkdir -p ~/.docker/trust/private/","shell":"sh"},{"name":"Write the trust key","run":"echo \"${{ inputs.private-key }}\" \u003e ~/.docker/trust/private/${{ inputs.private-key-id }}.key","shell":"sh"},{"name":"Chmod the trust key","run":"chmod 600 ~/.docker/trust/private/${{ inputs.private-key-id }}.key","shell":"sh"},{"name":"Load the trust key","run":"docker trust key load ~/.docker/trust/private/${{ inputs.private-key-id }}.key","shell":"sh","env":{"DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE":"${{ inputs.private-key-passphrase }}","DOCKER_CONTENT_TRUST":"1","DOCKER_CONTENT_TRUST_SERVER":"${{ inputs.notary-server }}"}},{"name":"Setup go","uses":"actions/setup-go@v5","with":{"go-version":"^1.22"}},{"name":"Setup the notary tool","run":"go install -tags pkcs11 github.com/theupdateframework/notary/cmd/notary@latest\nnotary --help\n","shell":"sh","env":{"GO111MODULE":"on"}},{"name":"List trust keys","run":"notary key list -d ~/.docker/trust/","shell":"sh","env":{"DOCKER_CONTENT_TRUST":"1"}},{"name":"Sign the local image (not a manifest)","run":"docker trust sign --local \"${IMAGE_REF}\"","shell":"sh","if":"${{ ! fromJSON(inputs.sign-manifest) }}","env":{"DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE":"${{ inputs.private-key-passphrase }}","DOCKER_CONTENT_TRUST":"1","DOCKER_CONTENT_TRUST_SERVER":"${{ inputs.notary-server }}","IMAGE_REF":"${{ inputs.image-ref }}"}},{"name":"Install jq if not found","run":"jq --version \u003e /dev/null || curl -sS https://webinstall.dev/jq | bash","shell":"sh","if":"${{ fromJSON(inputs.sign-manifest) }}"},{"name":"Sign the manifest","if":"${{ fromJSON(inputs.sign-manifest) }}","run":"set -eu;\nREPO=\"$(echo \"${IMAGE_REF}\" | cut -d ':' -f 1 | sed 's!docker.io/!!')\";\nREF=\"$(echo \"${IMAGE_REF}\" | cut -d ':' -f 1)\";\nTAG=\"$(echo \"${IMAGE_REF}\" | cut -d ':' -f 2)\";\necho \"Image-ref: ${REF}\";\necho \"Image-tag: ${TAG}\";\necho \"Repo-name: ${REPO}\";\nexport NOTARY_AUTH=\"$(printf \"${AUTH_BASIC}\" | base64 -w0)\";\nunset AUTH_BASIC;\nexport DOCKER_TOKEN=\"$(curl -s \"https://auth.docker.io/token?service=registry.docker.io\u0026scope=repository:${REPO}:pull\" -H \"Authorization: Basic ${NOTARY_AUTH}\" | jq -r '.token')\"\nBYTES_SIZE=\"$(curl -H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' https://registry-1.docker.io/v2/$REPO/manifests/$TAG -H \"Authorization: Bearer $DOCKER_TOKEN\" -XGET | wc -c)\"\nSHA_256=\"$(curl -H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' https://registry-1.docker.io/v2/$REPO/manifests/$TAG -H \"Authorization: Bearer $DOCKER_TOKEN\" -XGET | sha256sum | cut -d ' ' -f 1)\"\necho \"Manifest SHA-256: ${SHA_256}\";\necho \"Manifest-inspect BYTES: ${BYTES_SIZE}\";\nROLE_CLI='';\nif [ ! -z \"${{ inputs.private-key-name }}\" ]; then\n    echo \"Roles: targets/${{ inputs.private-key-name }}\";\n    ROLE_CLI=\"--roles \\\"targets/${{ inputs.private-key-name }}\\\"\"\nfi\necho \"Sign ${SHA_256} with the notary\"\nnotary -s \"${{ inputs.notary-server }}\" -d ~/.docker/trust/ addhash \"${REF}\" \"${TAG}\" \"${BYTES_SIZE}\" --sha256 \"${SHA_256}\" ${ROLE_CLI} --publish --verbose;\necho \"Done !\"\nnotary -s \"${{ inputs.notary-server }}\" list \"${REF}\";\nunset NOTARY_AUTH;\nunset DOCKER_TOKEN;\n","shell":"sh","env":{"AUTH_BASIC":"${{ inputs.notary-auth }}","IMAGE_REF":"${{ inputs.image-ref }}","DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE":"${{ inputs.private-key-passphrase }}","NOTARY_DELEGATION_PASSPHRASE":"${{ inputs.private-key-passphrase }}","DOCKER_CONTENT_TRUST":"1","DOCKER_CLI_EXPERIMENTAL":"enabled"}},{"name":"Inspect the trust","run":"docker trust inspect --pretty \"${{ inputs.image-ref }}\"","shell":"sh","env":{"DOCKER_CONTENT_TRUST":"1","DOCKER_CONTENT_TRUST_SERVER":"${{ inputs.notary-server }}"}},{"name":"Cleanup the trust key","run":"rm -v ~/.docker/trust/private/${{ inputs.private-key-id }}.key","shell":"sh"},{"name":"Cleanup the trust keys folder","run":"rm -rvf ~/.docker/trust/private","shell":"sh"}]},"default_branch":"main","path":null},"repo_metadata":{"uuid":"362444625","full_name":"sudo-bot/action-docker-sign","owner":"sudo-bot","description":"Sign your Docker images with DCT","archived":false,"fork":false,"pushed_at":"2024-04-28T19:51:07.000Z","size":81,"stargazers_count":6,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-04-28T20:42:06.391Z","etag":null,"topics":["dct","docker","docker-notary","docker-registry","docker-signatures","github-actions","security","signing"],"latest_commit_sha":null,"homepage":"","language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sudo-bot.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-04-28T11:34:19.000Z","updated_at":"2024-04-28T19:49:35.000Z","dependencies_parsed_at":"2024-01-01T16:41:39.323Z","dependency_job_id":"d491b7f4-3a6e-4c54-ac23-a2b0d5bd80c4","html_url":"https://github.com/sudo-bot/action-docker-sign","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sudo-bot%2Faction-docker-sign","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sudo-bot%2Faction-docker-sign/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sudo-bot%2Faction-docker-sign/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sudo-bot%2Faction-docker-sign/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sudo-bot","download_url":"https://codeload.github.com/sudo-bot/action-docker-sign/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":199818136,"owners_count":13643924,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"sudo-bot","name":"Sudo Bot","uuid":"66977076","kind":"organization","description":"Let humans do anything they want (to talk to me mention @sudo-robot )","email":null,"website":null,"location":"Internet","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/66977076?v=4","repositories_count":14,"last_synced_at":"2023-03-02T06:10:28.066Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/sudo-bot","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-12T23:49:10.241Z","updated_at":"2023-03-02T06:10:28.076Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sudo-bot","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sudo-bot/repositories"},"tags":[{"name":"latest","sha":"0317fec69cafadd83cf65298f425429691d358ce","kind":"tag","published_at":"2021-06-02T23:14:39.000Z","download_url":"https://codeload.github.com/sudo-bot/action-docker-sign/tar.gz/latest","html_url":"https://github.com/sudo-bot/action-docker-sign/releases/tag/latest","dependencies_parsed_at":"2023-06-01T10:42:48.171Z","dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sudo-bot%2Faction-docker-sign/tags/latest","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sudo-bot%2Faction-docker-sign/tags/latest/manifests"}]},"repo_metadata_updated_at":"2024-04-28T20:44:46.888Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":10,"rankings":{"downloads":null,"dependent_repos_count":12.20408810014261,"dependent_packages_count":0.0,"stargazers_count":17.562985263825066,"forks_count":35.17033750594201,"docker_downloads_count":null,"average":16.23435271747742},"purl":"pkg:githubactions/sudo-bot/action-docker-sign","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/actions/sudo-bot/action-docker-sign","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/actions/sudo-bot/action-docker-sign","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/actions/sudo-bot/action-docker-sign/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":null,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/sudo-bot%2Faction-docker-sign/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/sudo-bot%2Faction-docker-sign/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/sudo-bot%2Faction-docker-sign/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/sudo-bot%2Faction-docker-sign/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/sudo-bot%2Faction-docker-sign/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/sudo-bot%2Faction-docker-sign/codemeta","maintainers":[]}