Skip to content

Commit 48a2f82

Browse files
authored
Readme fixes and improvements (#448)
Signed-off-by: João Pereira <[email protected]>
1 parent 9c61577 commit 48a2f82

File tree

1 file changed

+16
-15
lines changed

1 file changed

+16
-15
lines changed

README.md

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -126,13 +126,10 @@ The following checks were performed on these signatures:
126126
OCI registries are useful for storing more than just container images!
127127
`Cosign` also includes some utilities for publishing generic artifacts, including binaries, scripts, and configuration files using the OCI protocol.
128128

129-
### Blobs
130-
131-
OCI registries are useful for storing more than just container images!
132-
`Cosign` also includes some utilities for publishing generic artifacts, including binaries, scripts, and configuration files using the OCI protocol.
133-
134129
This section shows how to leverage these for an easy-to-use, backwards-compatible artifact distribution system that integrates well with the rest of Sigstore.
135130

131+
### Blobs
132+
136133
You can publish an artifact with `cosign upload blob`:
137134

138135
```shell
@@ -196,11 +193,11 @@ The signature, claims and transparency log proofs are all verified automatically
196193

197194
#### Tekton Bundles
198195

199-
(Tekton)[https://tekton.dev] bundles can be uploaded and managed within an OCI registry.
200-
The specification is [here]https://tekton.dev/docs/pipelines/tekton-bundle-contracts/.
196+
[Tekton](https://tekton.dev) bundles can be uploaded and managed within an OCI registry.
197+
The specification is [here](https://tekton.dev/docs/pipelines/tekton-bundle-contracts/).
201198
This means they can also be signed and verified with `cosign`.
202199

203-
Tekon Bundles can curently be uploaded with the [tkn cli](github.com/tekton/cli), but we may add this support to
200+
Tekton Bundles can currently be uploaded with the [tkn cli](github.com/tekton/cli), but we may add this support to
204201
`cosign` in the future.
205202

206203
```shell
@@ -250,7 +247,7 @@ Today, `cosign` has been tested and works against the following registries:
250247
* Azure Container Registry
251248
* JFrog Artifactory Container Registry
252249
* The CNCF distribution/distribution Registry
253-
* Gitlab Container Registry
250+
* GitLab Container Registry
254251
* GitHub Container Registry
255252
* The CNCF Harbor Registry
256253
* Digital Ocean Container Registry
@@ -325,7 +322,7 @@ That looks like:
325322
**Note:** This can be generated for an image reference using `cosign generate <image>`.
326323

327324
I'm happy to switch this format to something else if it makes sense.
328-
See [https://github.com/notaryproject/nv2/issues/40] for one option.
325+
See https://github.com/notaryproject/nv2/issues/40 for one option.
329326

330327

331328
#### Registry Details
@@ -338,7 +335,7 @@ Similarly, they **can** easily be copied from one environment to another, but th
338335
automatic.
339336

340337
Multiple signatures are stored in a list which is unfortunately "racy" today.
341-
To add a signtaure, clients orchestrate a "read-append-write" operation, so the last write
338+
To add a signature, clients orchestrate a "read-append-write" operation, so the last write
342339
will win in the case of contention.
343340

344341
##### Specifying Registry
@@ -407,8 +404,6 @@ Right now cosign supports Hashicorp Vault, AWS KMS, and GCP KMS, and we are hopi
407404

408405
See the [KMS docs](KMS.md) for more details.
409406

410-
```
411-
412407
### OCI Artifacts
413408

414409
Push an artifact to a registry using [oras](https://github.com/deislabs/oras) (in this case, `cosign` itself!):
@@ -630,17 +625,23 @@ $ cosign verify -key cosign.pub dlorenc/demo | jq .
630625
"sig": "original"
631626
}
632627
}
628+
```
633629

634-
# Now give that signature a memorable name, then sign that
630+
Now give that signature a memorable name, then sign that:
631+
632+
```shell
635633
$ crane tag $(cosign triangulate dlorenc/demo) mysignature
636634
2021/02/15 20:22:55 dlorenc/demo:mysignature: digest: sha256:71f70e5d29bde87f988740665257c35b1c6f52dafa20fab4ba16b3b1f4c6ba0e size: 556
637635
$ cosign sign -key cosign.key -a sig=counter dlorenc/demo:mysignature
638636
Enter password for private key:
639637
Pushing signature to: dlorenc/demo:sha256-71f70e5d29bde87f988740665257c35b1c6f52dafa20fab4ba16b3b1f4c6ba0e.sig
640638
$ cosign verify -key cosign.pub dlorenc/demo:mysignature
641639
{"Critical":{"Identity":{"docker-reference":""},"Image":{"Docker-manifest-digest":"71f70e5d29bde87f988740665257c35b1c6f52dafa20fab4ba16b3b1f4c6ba0e"},"Type":"cosign container image signature"},"Optional":{"sig":"counter"}}
640+
```
641+
642+
Finally, check the original signature:
642643

643-
# Finally, check the original signature
644+
```shell
644645
$ crane manifest dlorenc/demo@sha256:71f70e5d29bde87f988740665257c35b1c6f52dafa20fab4ba16b3b1f4c6ba0e
645646
{
646647
"schemaVersion": 2,

0 commit comments

Comments
 (0)