2

I trying to play a bit with the Sigstore's cosign tool. The tool is signing the image and then uploading the signature to the same repository.

So if I have a tag - tool:latest and I sign it, the tool creates a new tag named - <digest_of_latest>.sig

I want to somehow download that tag's data, but if I try to docker pull - I get an error that docker cannot load the image (which is right, this is not real image).

is there a way to download the raw data file from the docker hub repository ?

Meir Tolpin
  • 325
  • 2
  • 13
  • Are you able to use [this script](https://github.com/moby/moby/blob/master/contrib/download-frozen-image-v2.sh) to download the raw manifest file? – Nick ODell Oct 31 '22 at 14:06
  • unfortunately no, it works with latest, but when I try to change the tag name to - sha256-f54a58bc1aac5ea1a25d796ae155dc228b3f0e11d046ae276b39c4bf2f13d8c4.sig it's getting 404 – Meir Tolpin Oct 31 '22 at 15:29
  • @MeirTolpin did you happen to find a solution for this? – Fooble Jul 11 '23 at 02:07

0 Answers0