Actions
Story #1146
closed
As a user, I am assured that Pulp is downloading trusted manifests
Status:
CLOSED - WONTFIX
Priority:
Normal
Assignee:
-
Start date:
Due date:
% Done:
0%
Estimated time:
Platform Release:
Target Release - Docker:
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:
Description
The v2 manifest[0] has support for cryptographic signatures. For this story, we need to learn how those signatures work and add support to the importer to verify the signatures of the downloaded manifests.
Deliverables:
- Add support to the importer to validate the signatures
- Consider whether this validation should be optional
- Add support to pulp-admin
- Documentation
- Tests
[0] https://github.com/docker/distribution/blob/release/2.0/docs/spec/manifest-v2-1.md
Actions
.