docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-10-23 18:09:02 +03:00
Code Activity

docs: explain Git transformations when signing kits

Browse Source 
The signing instructions did not account for Git changing signed file contents. Explain the signing warning and why local verification does not establish that committed bytes match.
This commit is contained in:
David Karlsson
2026-10-20 08:10:52 +00:00
parent d0e44568ec
commit 0c951c0ea9
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
content/manuals/ai/sandboxes/customize/kits-v2.md
View File

@@ -715,8 +715,14 @@ $ sbx kit verify --key cosign.pub ./my-kit/
For a local directory, `sbx kit sign` writes a `kit.sig.bundle` file next to
`spec.yaml`. Commit this file so consumers can verify a kit loaded from the Git
repository. For an OCI kit, the signature is stored as an OCI referrer. You can
sign an OCI kit after pushing it, or push and sign it in one step:
repository.
Git line-ending conversion and clean filters can invalidate a source signature.
If `sbx kit sign` warns about these transformations, ensure Git preserves the
signed files unchanged before sharing the Git reference.
For an OCI kit, the signature is stored as an OCI referrer. You can sign an OCI
kit after pushing it, or push and sign it in one step:
```console
$ sbx kit push ./my-kit/ ghcr.io/myorg/my-kit:1.0 --sign