OCI Vaultキーを使用してOCIRイメージに署名する

OCIボールトの作成

署名用RSA非対称キーの作成

キーOCIDとキーのバージョンOCIDをコピーする

OCIR（OCI Container Registry）のリポジトリを作成する

OCIRへログインのため認証トークンを作成する。

CloudShellを起動してOCIRへログインする

ynsheng_g@cloudshell:~ (ap-tokyo-1)$ oci os ns get
{
  "data": "<tenancy namespace>"
}
ynsheng_g@cloudshell:~ (ap-tokyo-1)$ docker login nrt.ocir.io
Username: <tenancy namespace>/[e-mail]
Password: <Auth Token>
Login Succeeded!
ynsheng_g@cloudshell:~ (ap-tokyo-1)$ 

Docker Hubからnginxイメージを取得する

ynsheng_g@cloudshell:~ (ap-tokyo-1)$ docker pull docker.io/library/nginx:latest
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob 50355e0ebcbc done   | 
Copying blob 4225c79b86e9 done   | 
Copying blob bf7af0229701 done   | 
Copying blob ac3ce1865cbf done   | 
Copying blob dd00b62474a6 done   | 
Copying blob fef72342d9bd done   | 
Copying blob a3d95972273c done   | 
Copying config 837d83d05b done   | 
Writing manifest to image destination
837d83d05b6db44d38803c877ef6e7e8c9c9ce009bd0bdf18c538150f48424f1
ynsheng_g@cloudshell:~ (ap-tokyo-1)$ docker images
REPOSITORY               TAG         IMAGE ID      CREATED     SIZE
docker.io/library/nginx  latest      837d83d05b6d  9 days ago  193 MB
ynsheng_g@cloudshell:~ (ap-tokyo-1)$

nginxイメージにOCIR用のタグ名を付ける

ynsheng_g@cloudshell:~ (ap-tokyo-1)$ docker tag 837d83d05b6d nrt.ocir.io/<tenancy namespace>/test/nginx:latest
ynsheng_g@cloudshell:~ (ap-tokyo-1)$ docker images
REPOSITORY                           TAG         IMAGE ID      CREATED     SIZE
nrt.ocir.io/nrhwgsvcclue/test/nginx  latest      837d83d05b6d  9 days ago  193 MB
docker.io/library/nginx              latest      837d83d05b6d  9 days ago  193 MB
ynsheng_g@cloudshell:~ (ap-tokyo-1)$

nginxイメージをOCIRにpushする

ynsheng_g@cloudshell:~ (ap-tokyo-1)$ docker push nrt.ocir.io/nrhwgsvcclue/test/nginx:latest
Getting image source signatures
Copying blob 5e5947a00297 done   | 
Copying blob e318dc369250 done   | 
Copying blob 1f3813f035c6 done   | 
Copying blob 6236ae37bb94 done   | 
Copying blob 136e74e8c111 done   | 
Copying blob 41d650510980 done   | 
Copying blob a7fa72f862f9 done   | 
Copying config 837d83d05b done   | 
Writing manifest to image destination
ynsheng_g@cloudshell:~ (ap-tokyo-1)$

OCIRへのpushは成功した。
署名用のため、OCIDをコピーする。

署名用のため、コンパートメントOCIDをコピーする。

下記コマンドでnginxイメージを署名する

oci artifacts container image-signature sign-upload \
  --compartment-id <compartment-ocid> \
  --kms-key-id <kms-key-ocid> \
  --kms-key-version-id <kms-key-version-ocid> \
  --signing-algorithm SHA_224_RSA_PKCS_PSS \
  --image-id <container-image-ocid> \
  --description "to sign image"

ynsheng_g@cloudshell:~ (ap-tokyo-1)$ oci artifacts container image-signature sign-upload \
>   --compartment-id ocid1.compartment.oc1..aaaaaaaabxs4zlzf4z2i2skpp6apexwxxxxxxxxxxxxxxxxxxxxxxkgtfcyq \
>   --kms-key-id ocid1.key.oc1.ap-tokyo-1.ezvkjfvaaacgs.abxhiljr6yyt2rmvenmjcazie3akcbauwn3c5szegevjvwgt36jovwuczcra \
>   --kms-key-version-id ocid1.keyversion.oc1.ap-tokyo-1.ezvkjfvaaacgs.cuq6nksjstaaa.abxhiljraqbidbjow3i43ey4sv2o2e27y5bwq5uquxiwg6bedquhwyb6nu6q \
>   --signing-algorithm SHA_224_RSA_PKCS_PSS \
>   --image-id ocid1.containerimage.oc1.ap-tokyo-1.0.nrhwgsvcclue.aaaaaaaawgh3ml22e4mqur4kgbyftf7kqhwx2hfs5zuzqc7htcsjkbwgnxpa \
>   --description "to sign image"
Obtaining container image metadata by the image ID
Generating signature
Signature: kZ8B8fJPymoz73xobHl72Y4nvUfvcansXsTH8JtQ+j2lTb/btRyduXx3Z38CdJ8L2FuU54RKPfulfZgDLx0UK52fLohaKd7g44IrnZ8A+SqbQ1LMpiFHZNJtliezaBxC3zsD2QZ9XK+EFlsm64TKnE6juQfSe8ON8iD4t6kqIiSyQbR+dE4cdDeL5nuB/c0AeSQApDyoZVX5nE/JJd/HPPGWLC5Hi5QO2oJVmG6JAekUvnlsj4la9S6tTCeETyczFh6VF1jro39nbNHr/IthafiGhQTzmDcepBIfChuJZx1Adb/suThhHapby6kvmfzlbiBDhxa+Lrtq091eAoSNLA==
Uploading signature
Uploaded signature: kZ8B8fJPymoz73xobHl72Y4nvUfvcansXsTH8JtQ+j2lTb/btRyduXx3Z38CdJ8L2FuU54RKPfulfZgDLx0UK52fLohaKd7g44IrnZ8A+SqbQ1LMpiFHZNJtliezaBxC3zsD2QZ9XK+EFlsm64TKnE6juQfSe8ON8iD4t6kqIiSyQbR+dE4cdDeL5nuB/c0AeSQApDyoZVX5nE/JJd/HPPGWLC5Hi5QO2oJVmG6JAekUvnlsj4la9S6tTCeETyczFh6VF1jro39nbNHr/IthafiGhQTzmDcepBIfChuJZx1Adb/suThhHapby6kvmfzlbiBDhxa+Lrtq091eAoSNLA==
Message: eyJkZXNjcmlwdGlvbiI6InRvIHNpZ24gaW1hZ2UiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjoyNzAwZmZkNjIzODQzYWViODc3OTM1YzVmOGQzN2MzOWEzZmY5OGI0MWFlNzdiYjc3ODkwOGNjNTRkMzE5OGQ3Iiwia21zS2V5SWQiOiJvY2lkMS5rZXkub2MxLmFwLXRva3lvLTEuZXp2a2pmdmFhYWNncy5hYnhoaWxqcjZ5eXQycm12ZW5tamNhemllM2FrY2JhdXduM2M1c3plZ2V2anZ3Z3QzNmpvdnd1Y3pjcmEiLCJrbXNLZXlWZXJzaW9uSWQiOiJvY2lkMS5rZXl2ZXJzaW9uLm9jMS5hcC10b2t5by0xLmV6dmtqZnZhYWFjZ3MuY3VxNm5rc2pzdGFhYS5hYnhoaWxqcmFxYmlkYmpvdzNpNDNleTRzdjJvMmUyN3k1YndxNXVxdXhpd2c2YmVkcXVod3liNm51NnEiLCJtZXRhZGF0YSI6IiIsInJlZ2lvbiI6ImFwLXRva3lvLTEiLCJyZXBvc2l0b3J5TmFtZSI6InRlc3QvbmdpbngiLCJzaWduaW5nQWxnb3JpdGhtIjoiU0hBXzIyNF9SU0FfUEtDU19QU1MifQ==
ID: ocid1.containerimagesignature.oc1.ap-tokyo-1.0.nrhwgsvcclue.aaaaaaaake4kmxds3mxarkhjf25cgnbovodp6pshbcyzc2jyyqvrtkbwmw2a
{
  "data": {
    "compartment-id": "ocid1.compartment.oc1..aaaaaaaabxs4zlzf4z2i2skpp6apexwxxxxxxxxxxxxxxxxxxxxxxkgtfcyq",
    "created-by": "ocid1.user.oc1..aaaaaaaathg3d4l2g3myvfm3zsxxxxxxxxxxxxxxxxxxxxxx5il3ddg2vclq",
    "defined-tags": {},
    "display-name": "jovwuczcra::uhwyb6nu6q::SHA_224_RSA_PKCS_PSS::vrtkbwmw2a",
    "freeform-tags": {},
    "id": "ocid1.containerimagesignature.oc1.ap-tokyo-1.0.nrhwgsvcclue.aaaaaaaake4kmxds3mxarkhjf25cgnbovodp6pshbcyzc2jyyqvrtkbwmw2a",
    "image-id": "ocid1.containerimage.oc1.ap-tokyo-1.0.nrhwgsvcclue.aaaaaaaawgh3ml22e4mqur4kgbyftf7kqhwx2hfs5zuzqc7htcsjkbwgnxpa",
    "kms-key-id": "ocid1.key.oc1.ap-tokyo-1.ezvkjfvaaacgs.abxhiljr6yyt2rmvenmjcazie3akcbauwn3c5szegevjvwgt36jovwuczcra",
    "kms-key-version-id": "ocid1.keyversion.oc1.ap-tokyo-1.ezvkjfvaaacgs.cuq6nksjstaaa.abxhiljraqbidbjow3i43ey4sv2o2e27y5bwq5uquxiwg6bedquhwyb6nu6q",
    "lifecycle-state": "AVAILABLE",
    "message": "eyJkZXNjcmlwdGlvbiI6InRvIHNpZ24gaW1hZ2UiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjoyNzAwZmZkNjIzODQzYWViODc3OTM1YzVmOGQzN2MzOWEzZmY5OGI0MWFlNzdiYjc3ODkwOGNjNTRkMzE5OGQ3Iiwia21zS2V5SWQiOiJvY2lkMS5rZXkub2MxLmFwLXRva3lvLTEuZXp2a2pmdmFhYWNncy5hYnhoaWxqcjZ5eXQycm12ZW5tamNhemllM2FrY2JhdXduM2M1c3plZ2V2anZ3Z3QzNmpvdnd1Y3pjcmEiLCJrbXNLZXlWZXJzaW9uSWQiOiJvY2lkMS5rZXl2ZXJzaW9uLm9jMS5hcC10b2t5by0xLmV6dmtqZnZhYWFjZ3MuY3VxNm5rc2pzdGFhYS5hYnhoaWxqcmFxYmlkYmpvdzNpNDNleTRzdjJvMmUyN3k1YndxNXVxdXhpd2c2YmVkcXVod3liNm51NnEiLCJtZXRhZGF0YSI6IiIsInJlZ2lvbiI6ImFwLXRva3lvLTEiLCJyZXBvc2l0b3J5TmFtZSI6InRlc3QvbmdpbngiLCJzaWduaW5nQWxnb3JpdGhtIjoiU0hBXzIyNF9SU0FfUEtDU19QU1MifQ==",
    "signature": "kZ8B8fJPymoz73xobHl72Y4nvUfvcansXsTH8JtQ+j2lTb/btRyduXx3Z38CdJ8L2FuU54RKPfulfZgDLx0UK52fLohaKd7g44IrnZ8A+SqbQ1LMpiFHZNJtliezaBxC3zsD2QZ9XK+EFlsm64TKnE6juQfSe8ON8iD4t6kqIiSyQbR+dE4cdDeL5nuB/c0AeSQApDyoZVX5nE/JJd/HPPGWLC5Hi5QO2oJVmG6JAekUvnlsj4la9S6tTCeETyczFh6VF1jro39nbNHr/IthafiGhQTzmDcepBIfChuJZx1Adb/suThhHapby6kvmfzlbiBDhxa+Lrtq091eAoSNLA==",
    "signing-algorithm": "SHA_224_RSA_PKCS_PSS",
    "system-tags": {},
    "time-created": "2026-09-12T01:39:23.468941+00:00"
  },
  "etag": "bovodp6pshbcyzc2jyyqvrtkbwmw2a-1"
}
ynsheng_g@cloudshell:~ (ap-tokyo-1)$

署名を検証する

検証成功した

以上