Verify Container Images

Ordyn Docker images are signed with Cosign.

Each compose service folder contains the public key at:

text

keys/ordyn-cosign-v1.pub

Operators are responsible for verifying Ordyn images before starting or updating containers.

Requirements

Install Cosign on every Ordyn infrastructure machine that pulls, updates, or runs Ordyn Docker images.

Install the verification helper:

bash

apt update
apt install -y git python3-yaml python3-dotenv
git clone https://github.com/Hank-IT/cosign-docker-verify.git /opt/cosign-docker-verify