Signed Images from the Red Hat Container Catalog

As a follow-up to my introduction of simple signing, I’m excited to announce that Red Hat is now serving signatures for Red Hat Container Catalog Images!

In May, Red Hat announced the Container Health Index, providing an aggregate safety rating for container images in our public registry. As part of our commitment to delivering trusted content, we are now serving signed images. This means that customers can now configure a Red Hat Enterprise Linux host to cryptographically verify that images have come from Red Hat when they are pulled onto the system. This is a significant step in advancing the security of container hosts, providing assurance of provenance and integrity and enabling non-repudiation. Non-repudiation simply means that the signer cannot deny their signature—a key security principle for digital transactions.

The configuration can be performed in a single command, demonstrated in this 60-second video.

Atomic CLI “trust” manages the trusted registries for a host system. Here’s the command from the video:

# atomic trust add \
--pubkeys /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release \
--sigstore https://access.redhat.com/webassets/docker/content/sigstore \
registry.access.redhat.com

Let’s look at each argument of the command:

  1. This command is adding a new trust rule to the system.
  2. The trusted public key is the same key used for RPMs. It’s critical that this key is indeed Red Hat’s public key so we’re using the installed key. This key can be verified with rpm --verify redhat-release-atomic-host.
  3. The signature server, or “sigstore”, is the web server that contains the signatures. Tools like docker daemon will find the signatures using the image name and digest hash.
  4. Trust is associated with the registry.access.redhat.com registry. Once you execute this command all images from this registry will require a signature.

The demonstration uses docker-latest, version 1.13, while an issue in docker version 1.12 is being resolved. To try this out, be sure to enable signature verification in the docker daemon. Signatures are only being applied to Red Hat’s images at this time. Certified partner images in registry.connect.redhat.com are not signed at this time.

See Red Hat Enterprise Linux Atomic Host documentation and the Container Image Signing Integration Guide for more information, including how to use the atomic CLI to manage registry trust, signing images and options for distributing signatures.

Red Hat Enterprise Linux Brings Forth Performance and Scalability Features of New Intel Xeon Processor Family

Last week, Intel launched the new family of Intel® Xeon® scalable processors with new features such as Intel Advanced Vector Extensions 512 (Intel AVX-512), which boost performance of computationally intensive tasks, a new Intel Mesh Architecture for reduced system latency, Intel QuickAssist Technology for hardware acceleration of cryptography and data compression operations and integrated high-speed fabric with Intel Omni-Path Architecture. According to Intel, 

Continue reading “Red Hat Enterprise Linux Brings Forth Performance and Scalability Features of New Intel Xeon Processor Family”

Time to Upgrade to Red Hat Virtualization 4

It has been over five years since the release of Red Hat Enterprise Virtualization 3.0. In just under 3 months (September 30) it will hit the end of it’s support lifecycle, and we will retire the 3.x version. At that same time, Red Hat Virtualization 4.0 will have been out for 13 months, and 4.1 for 5 months.

If you have not yet started the upgrade plan and process from version 3 to version 4, now is the time.

Continue reading “Time to Upgrade to Red Hat Virtualization 4”