Verify the image authenticity

Check Tuleap Enterprise image

We sign the Tuleap Enterprise Docker image each time we publish it. The image is signed using cosign.

You can verify an image authenticity by downloading our public key into a file named tuleap_enterprise_docker.pub and then running:

$ cosign verify --key tuleap_enterprise_docker.pub docker.tuleap.org/tuleap-enterprise-edition:<tuleap_version>

On success the output will look something like this:

Verification for docker.tuleap.org/tuleap-enterprise-edition:<tuleap_version> --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The signatures were verified against the specified public key
{"critical":{"identity":{"docker-reference":"docker.tuleap.org/tuleap-enterprise-edition"},"image":{"docker-manifest-digest":"sha256:<digest>"},"type":"cosign container image signature"},"optional":null}