Proxy cached image does not have it signature cached to the repository

[Pavan-Gunda]

Hi!

I've been testing harbor's proxy cache and found that when harbor caches an image in a proxy cache repository, it does not fetch the image's signature.

For example:

DOCKER_CONTENT_TRUST=1 docker pull harbor.com/docker/library/ubuntu@sha256:d86db849e59626d94f768c679aba441163c996caf7a3426f44924d0239ffe03f 

Then the pulled image from harbor, does not have a signature associated with it.

❯ docker trust inspect harbor.com/docker/library/ubuntu@sha256:d86db849e59626d94f768c679aba441163c996caf7a3426f44924d0239ffe03f 
[]
no signatures or cannot access harbor.com/docker/library/ubuntu@sha256:d86db849e59626d94f768c679aba441163c996caf7a3426f44924d0239ffe03f

• Is this the intended behaviour of proxy cache ?
• Is it possible to somehow use a proxy cache and also get the signing data?

[stonezdj]

We have deprecated the notary v1 support in Harbor v2.9.0

[Pavan-Gunda]

And docker trust is built on top of notary and that seems to be why it cannot verify those images. This answers my question.

Thanks :)