Skip to content

Container image signing

NGTS Kubernetes component images are signed with the Palo Alto Networks public key, so you can be sure that Palo Alto Networks built and provided them, even when they're mirrored to your own registry.

To verify an image's signature with cosign verify:

  1. Save the following public key to a file named ngts-tpp-codesign.pub.

    -----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAo4587SAZPQObOqdWFj8z
F9RFqtsB9bVjIIqdFLofjuAa2ZKlE5Qax/2mwllUoAjm4T1LsZ8i3zDZwsEhzdF1
UVfOQJLMKhxPyzzPbAIwgV3tdazSmCccWFr8W5sSYxyi7pwZ6VHQeHY8xnOkZoMX
ValuqSH+q0h8u7nXBFB+DJI+0L8ed4HfoXY1yKcu3PhBRb/XCYn1YFeqMlqmBtRg
U9qtPUM6DDa8UqHJNKSC3ZVf8xmQNGlQAzNd8ntjlVFjBNhzXbSRj93NZG5M/5E7
E8sXkPmwUK8dCJZ7GVMoWxJxtQP+cO40jCxnXElIsDeff1zJmPlchuStxlxU4qYq
k7Mij2l4I5sHT/Hx2wQ1hLxzVkLwOLq0DwtgJPdNxbgZZ+LyU2KdLsRnUY7hP6sw
V+yPPczHGIEIxE13Xc18hn/BYXe+iOfp+wPHEzrCBDrfJ9W+lNIQw5nwD0rOf3xN
5+6q5AuRqyzwpJvmDwODjvnjF0wSxFVTzB7s3Kh6R2iDe8j9fbN5o+zOmYMvufV0
ntiZC04EVvCFBVcF1lN6ZcINxICVF77IYf4iDkKCxby3EI6GXXlrDhtdb7U27lEc
6W+xZm/KQ26PsCUK4m6TfDko1X3rBKTtAyUPCmj7biDaUT47LTJZeGjWccQqQrkV
AId/PlkQW+PbggY3CTQwF9sCAwEAAQ==
-----END PUBLIC KEY-----

  2. Run cosign verify, substituting <latest-version> with the version you want to verify. For example, to verify Distributed Issuer:

    cosign verify registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:<latest-version> \
  --key ./ngts-tpp-codesign.pub \
  --insecure-ignore-tlog

    About transparency logs

    NGTS images aren't recorded in a transparency log, so you must include the --insecure-ignore-tlog flag to skip transparency log verification.

    If successful, the command exits with code 0 and prints output confirming the signature, for example:

    Verification for registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key