Adding and Removing Signers and Keys in Docker Trust

No signatures for registry.example.com/admin/demo List of signers and their keys for registry.example.com/admin/demo SIGNER KEYS jeff 1091060d7bfd Administrative keys for registry.example.com/admin/demo Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7 ``` You could also use the Notary CLI to list delegations and keys. Here you can clearly see the keys were attached to `targets/releases` and `targets/jeff`. ```console $ notary delegation list registry.example.com/admin/demo ROLE PATHS KEY IDS THRESHOLD ---- ----- ------- --------- targets/jeff "" <all paths> 1091060d7bfd938dfa5be703fa057974f9322a4faef6f580334f3d6df44c02d1 1 targets/releases "" <all paths> 1091060d7bfd938dfa5be703fa057974f9322a4faef6f580334f3d6df44c02d1 1 ``` ### Adding additional signers Docker Trust allows you to configure multiple delegations per repository, allowing you to manage the lifecycle of delegations. When adding additional delegations with `$ docker trust` the collaborators key is once again added to the `targets/release` role. > Note you will need the passphrase for the repository key; this would have been > configured when you first initiated the repository. ```console $ docker trust signer add --key ben.pub ben registry.example.com/admin/demo Adding signer "ben" to registry.example.com/admin/demo... Enter passphrase for repository key with ID b0014f8: Successfully added signer: ben to registry.example.com/admin/demo ``` Check to prove that there are now 2 delegations (Signer). ```console $ docker trust inspect --pretty registry.example.com/admin/demo No signatures for registry.example.com/admin/demo List of signers and their keys for registry.example.com/admin/demo SIGNER KEYS ben afa404703b25 jeff 1091060d7bfd Administrative keys for registry.example.com/admin/demo Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7 ``` ### Adding keys to an existing delegation To support things like key rotation and expiring / retiring keys you can publish multiple contributor keys per delegation. The only prerequisite here is to make sure you use the same the delegation name, in this case `jeff`. Docker trust will automatically handle adding this new key to `targets/releases`. > [!NOTE] > > You will need the passphrase for the repository key; this would have been > configured when you first initiated the repository. ```console $ docker trust signer add --key cert2.pem jeff registry.example.com/admin/demo Adding signer "jeff" to registry.example.com/admin/demo... Enter passphrase for repository key with ID b0014f8: Successfully added signer: jeff to registry.example.com/admin/demo ``` Check to prove that the delegation (Signer) now contains multiple Key IDs. ```console $ docker trust inspect --pretty registry.example.com/admin/demo No signatures for registry.example.com/admin/demo List of signers and their keys for registry.example.com/admin/demo SIGNER KEYS jeff 1091060d7bfd, 5570b88df073 Administrative keys for registry.example.com/admin/demo Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7 ``` ### Removing a delegation If you need to remove a delegation, including the contributor keys that are attached to the `targets/releases` role, you can use the `$ docker trust signer remove` command. > [!NOTE] > > Tags that were signed by the removed delegation will need to be resigned

Docker Trust allows configuring multiple delegations per repository for managing lifecycles. Adding delegations with `$ docker trust signer add` adds the collaborator's key to the `targets/release` role, requiring the repository key passphrase. Multiple contributor keys per delegation can be published for key rotation by using the same delegation name. Removing a delegation, including its keys attached to the `targets/releases` role, is done using `$ docker trust signer remove`.