验证包的完整性

MongoDB 使用数字签名来认证每个 mongot 包都是有效且未经修改的发布。验证 mongot 容器图像以确认其真实性。

Community Edition

下载 PEM 文件。

运行以下命令，将 PEM文件另存为 mongodb-search-community.pem：

curl -fsSL \  https://cosign.mongodb.com/mongodb-search-community.pem \  -o mongodb-search-community.pem

验证容器映像。

将 {VERSION} 替换为 mongot 版本标签，然后运行以下命令：

COSIGN_REPOSITORY=docker.io/mongodb/signatures \cosign verify --private-infrastructure \  --key=./mongodb-search-community.pem \  "docker.io/mongodb/mongodb-community-search:{VERSION}"

成功的输出类似于以下内容：

Verification for index.docker.io/mongodb/mongodb-community-search:{VERSION} --The following checks were performed on each of these signatures:  - The cosign claims were validated  - The signatures were verified against the specified public key

企业版

下载 PEM 文件。

运行以下命令，将 PEM文件另存为 mongodb-enterprise-kubernetes-operator.pem：

wget \  https://cosign.mongodb.com/mongodb-enterprise-kubernetes-operator.pem

验证容器映像。

将 {VERSION} 替换为 mongot 版本标签，然后运行以下命令：

cosign verify \  --key mongodb-enterprise-kubernetes-operator.pem \  quay.io/mongodb/mongodb-search:{VERSION} \  --insecure-ignore-tlog

成功的输出类似于以下内容：

WARNING: Skipping tlog verification is an insecure practice that lacks of transparency and auditability verification for the signature.
Verification for quay.io/mongodb/mongodb-search:{VERSION} --The following checks were performed on each of these signatures:  - The cosign claims were validated  - The signatures were verified against the specified public key