Replicate Signing capabilities of images with standard Harbor replication

[michmike]

we need to make sure that when images are signed, there is a way for replication to honor the signed component of the images.

[reasonerjt]

We leverage docker content trust and notary for signing the image, last time I checked the signature is tied to GUN which is the uri of the image, so when you replicate the uri of the image changed, it should be considered a different resource in notary, and has to be signed again.

This is the biggest gap I can think about right now, we may need to think about other signing solution if we want to support this.

[phenixblue]

Ditto to the above. We would like to see this feature to allow for a simpler HA setup of Harbor using bi-directional replication between 2 or more Harbor instances and still allow for proper signing and policy enforcement post replication

[michmike]

Hi Daniel, what if we enabled customers to.provide their own vanity URL for a project that's also behind a Load Balancer. two projects that are geodistributed and replicated can have the same URL and the LB can dictate where requests go. Would that be able to ensure signing is replicated?

[michmike]

Cc: @alexvmw

[xaleeks]

This seems difficult if we go through notary since the hostname is part of the GUN Daniel referenced. as confirmed here: notaryproject/notary#1023

[xaleeks]

docker knows of this limitation and has decided to solve this in notary 2.0 for all oci-compliant artifacts, we will be following progress that docker is making on https://cloud-native.slack.com/archives/CQUH8U287

[axi92]

Sry to dig this up, but is there any further information how to deal with that problem?

[brackend]

Hi, can/does Harbor verify the source signature of the incoming image. Although the signature does not transit along with the image because of gun, it should still verify the source signature on reception.

[wy65701436]

Since Harbor v2.5 is GAed, the it provides the cosign as the image sign solution and supports signature replication. As for cosign usage, you can refer to the goharbor.io, and especial for this PR.

And BTW, harbor is planning to deprecate notary v1 support, so we will not introduce any fix & enhancement for notary.

[brackend]

Thank you Yan!
Linked #16679 to this