northtyphoon

Generate certificate chain pem file (root ca on the top)

 openssl pkcs12 -in my.pfx -out ca.pem -cacerts -nokeys

Generate client certificate pem file

 openssl pkcs12 -in my.pfx -out key.pem -nocerts

northtyphoon

Test notary v2

Start local test registry on localhost:5000

docker run --rm -d -p 5000:5000 -v "$(pwd)"/registry:/var/lib/registry --name registry ghcr.io/oras-project/registry:latest

Install oras

northtyphoon

# Prerequisite
# 1) Install curl, jq

user_name="mytokenname" # it can be admin name, service principal client id or scopemap token name
user_password="mytokenpassword" # it can be admin password, service principal password or scopemap token password
repo="hello-world"
tag="latest"
registry="myregistry.azurecr.io"
scope="repository:$repo:pull"

northtyphoon

#!/bin/bash

# Prerequisite
# 1) Install jq, azure-cli
# 2) Install docker and enable docker cli experiment feature

badimagefile="badimage_$(date +"%Y%m%dT%H%M").txt"
registry="myregistry"
subscription="mysubscription"

northtyphoon

version: v1.1.0

alias:
  values:
    oras: ghcr.io/oras-project/oras:v0.16.0

steps:
 # write artifact.txt to current working folder

northtyphoon

Prepare

Create a test folder with the following 3 files

1. Dockerfile

version: v1.1.0

steps:

northtyphoon

#!/bin/bash

# Prerequisite
# 1) Install curl, jq

token_name="mytokenname"
token_password="mytokenpassword"
repo="hello-world"
tag="latest"

northtyphoon

#!/bin/bash

# Prerequisite
# 1) Install curl, jq

token_name="mytokenname"
token_password="mytokenpassword"
repo="windows"
tag="ltsc2022"

northtyphoon

# Prerequisite
# 1) Install curl, jq, oras (0.15.0 and older version)

registry="mcr.microsoft.com"
repo="oss/fluent/fluent-bit"
tag="v1.9.6"
artifact_type="application/vnd.cncf.notary.v2.signature"
accept_header="Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.cncf.oras.artifact.manifest.v1+json, */*"

northtyphoon

# Prerequisite
# 1) Install azure-cli

registry_name="myregistry"
task_name="mypurgetask"
cmd="acr purge --filter 'hello-world:.*' --untagged --ago 1d --dry-run"

echo "enable trusted service on registry: $registry_name"
registry_login_server=$(az acr update -n $registry_name --allow-trusted-services true --query "loginServer" -o tsv)