Importing a delegation certificate

As a repository owner:

  1. Add the delegation key to the repository using the targets/releases path, as this is what Docker searches for when signing an image (first targets, then targets/releases:

    1. ❯ notary delegation -D -v -s https://127.0.0.1:4443 -d ~/.docker/trust add <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app targets/releases delegation.crt --all-paths
    3. Addition of delegation role targets/releases with keys [e93a68479026f002b9dedb35f563cf5abc50aecd18b2205ad296d3101c0d3c21], with paths ["" <all paths>], to repository "<aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app" staged for next publish.

  2. Check the unpublished (staged) changes:

    1. ❯ notary -D -v -s https://127.0.0.1:4443 -d ~/.docker/trust status <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
    3. Unpublished changes for <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app:
    5. #    ACTION    SCOPE               TYPE          PATH
    6. -    ------    -----               ----          ----
    7. 0    create    targets/releases    delegation
    8. 1    create    targets/releases    delegation

  3. Publish the queued changes:

    1. ❯ notary -v -s https://127.0.0.1:4443 -d ~/.docker/trust publish <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
    3. Pushing changes to <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
    4. Enter passphrase for targets key with ID 79a6fca:
    5. Successfully published changes for repository <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app

    Enter the previously created targets repository key passphrase.

  4. Confirm the delegation list looks correct:

    1. ❯ notary -v -s https://127.0.0.1:4443 -d ~/.docker/trust delegation list <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/app
    3. ROLE                PATHS             KEY IDS                    THRESHOLD
    4. ----                -----             -------                    ---------
    5. targets/releases    "" <all paths>    61a6430…                   1