Sign an image and make the runtime refuse an unsigned one

short · 50 min · Objective 4.3

Task

Signing without enforced verification achieves nothing. Build the whole chain: sign an image, configure verification, and then prove it by attempting to run something unsigned.

Steps

  1. Run a local registry. Build an image, push it, and record its DIGEST -- not just its tag -- in lab/signing.md.
  2. Generate a signing key, sign the image, and verify the signature manually. Capture the successful verification.
  3. Configure the runtime or an admission policy to require a valid signature from your key before running an image.
  4. Attempt to run an UNSIGNED image and capture the refusal in lab/unsigned-refused.txt.
  5. Now demonstrate why digests matter: push a different image to the same TAG, and show that the tag now points at different content while the original digest still identifies the original bytes.

Verify

grep -Eci 'sha256:' lab/signing.md
test -s lab/unsigned-refused.txt && grep -Eci 'refus|denied|not signed|invalid' lab/unsigned-refused.txt
grep -Eci 'tag' lab/signing.md
grep -Eci 'digest' lab/signing.md

The refusal capture is the essential artefact. A signing setup that has never rejected anything has not been shown to enforce anything.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.