Fetch the public key used to sign an image in Notary.

fetch-root-key.sh

#!/bin/bash
#
# Fetches the root public key used to sign an image in Notary, e.g. to configure Connaisseur.
#
# E.g.:
#   ./fetch-root-key.sh https://notary.docker.io docker.io/securesystemsengineering/connaisseur

NOTARY=${1:-https://notary.docker.io}
IMAGE=${2:-docker.io/library/alpine}
TMP=$(mktemp -d)

echo "# NOTARY: ${NOTARY}" >&2
echo "# IMAGE: ${IMAGE}" >&2
echo "# TMP: ${TMP}" >&2

# Populate $TMP/trust/tuf/ metadata
notary -s $NOTARY -d $TMP list $IMAGE 2>&1 > /dev/null

# Fetch keyid of root
ROOTID=$(cat "${TMP}/tuf/${IMAGE}/metadata/root.json"  | jq -r '.signed.roles.root.keyids[]')

# Fetch encoded certificate
ROOTB64=$(cat "${TMP}/tuf/${IMAGE}/metadata/root.json"  | jq -r ".signed.keys.${ROOTID}.keyval.public")

# Decode certificate
echo -n $ROOTB64 | base64 --decode > $TMP/root.cer

# Generate public key from certificate
openssl x509 -inform pem -in $TMP/root.cer -pubkey -noout