.nh
.TH podman\-image\-sign(1)
.SH NAME
.PP
podman\-image\-sign \- Create a signature for an image

.SH SYNOPSIS
.PP
\fBpodman image sign\fP [\fIoptions\fP] \fIimage\fP [\fIimage\fP ...]

.SH DESCRIPTION
.PP
\fBpodman image sign\fP will create a local signature for one or more local images that have
been pulled from a registry. The signature will be written to a directory
derived from the registry configuration files in \fB\fC$HOME/.config/containers/registries.d\fR if it exists,
otherwise \fB\fC/etc/containers/registries.d\fR (unless overridden at compile\-time), see \fBcontainers\-registries.d(5)\fP for more information.
By default, the signature will be written into \fB\fC/var/lib/containers/sigstore\fR for root and \fB\fC$HOME/.local/share/containers/sigstore\fR for non\-root users

.SH OPTIONS
.SS \fB\-\-help\fP, \fB\-h\fP
.PP
Print usage statement.

.SS \fB\-\-all\fP, \fB\-a\fP
.PP
Sign all the manifests of the multi\-architecture image (default false).

.SS \fB\-\-cert\-dir\fP=\fIpath\fP
.PP
Use certificates at \fIpath\fP (*\&.crt, *\&.cert, *\&.key) to connect to the registry.
Default certificates directory is \fI/etc/containers/certs.d\fP\&. (Not available for remote commands)

.SS \fB\-\-directory\fP, \fB\-d\fP=\fIdir\fP
.PP
Store the signatures in the specified directory.  Default: /var/lib/containers/sigstore

.SS \fB\-\-sign\-by\fP=\fIidentity\fP
.PP
Override the default identity of the signature.

.SH EXAMPLES
.PP
Sign the busybox image with the identify of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/.

.PP
sudo podman image sign \-\-sign\-by foo@bar.com \-\-directory /tmp/signatures docker://privateregistry.example.com/foobar

.SH RELATED CONFIGURATION
.PP
The write (and read) location for signatures is defined in YAML\-based
configuration files in /etc/containers/registries.d/ for root,
or $HOME/.config/containers/registries.d for non\-root users.  When you sign
an image, Podman will use those configuration files to determine
where to write the signature based on the the name of the originating
registry or a default storage value unless overridden with the \-\-directory
option. For example, consider the following configuration file.

.PP
docker:
  privateregistry.example.com:
    sigstore: file:///var/lib/containers/sigstore

.PP
When signing an image preceded with the registry name 'privateregistry.example.com',
the signature will be written into sub\-directories of
/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means
the signature will be 'read' from that same location on a pull\-related function.

.SH SEE ALSO
.PP
containers\-registries.d(5)

.SH HISTORY
.PP
November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com)