Experimental Keyless Cosign verify-blob command to verify the signature that is exported by the skopeo tool to the directory
Let's assume that we have an image called devopps/busybox:glibc
, we gain this image by copying the real busybox:glibc
image from DockerHub by issuing the following command:
$ crane copy busybox:glibc devopps/busybox:glibc
crane is a tool for interacting with remote images and registries. https://github.com/google/go-containerregistry/tree/main/cmd/crane