apptainer-sign
Cryptographically sign SIF container images
TLDR
Sign an image with the default PGP key
$ apptainer sign [path/to/image.sif]
Choose which key in the keyring to sign with$ apptainer sign --keyidx [1] [path/to/image.sif]
Sign with a PEM private key rather than PGP$ apptainer sign --key [path/to/private.pem] [path/to/image.sif]
Sign every object the image contains$ apptainer sign --all [path/to/image.sif]
Sign one object group$ apptainer sign --group-id [1] [path/to/image.sif]
Sign a single object by its SIF id$ apptainer sign --sif-id [3] [path/to/image.sif]
SYNOPSIS
apptainer sign [options] image.sif
DESCRIPTION
apptainer sign adds digital signatures to SIF container images, enabling verification of image integrity and authenticity. Signatures can use PGP keys or X.509 certificates.Signing containers is essential for establishing trust in shared container images and meeting security requirements in production environments.
PARAMETERS
--key file
Path to a private key file for signing-k, --keyidx index
Index of the PGP key to use from the keyring-g, --group-id id
Sign only a specific object group within the SIF-i, --sif-id id
Sign only a specific object by ID within the SIF
INSTALL
sudo dnf install apptainer
sudo pacman -S apptainer
sudo apk add apptainer
sudo zypper install apptainer
brew install apptainer
nix profile install nixpkgs#apptainer
CAVEATS
A PGP key pair or X.509 certificate must be configured before signing. The private key must be kept secure; compromised keys should be revoked immediately.
SEE ALSO
apptainer(1), apptainer-verify(1), apptainer-pull(1), gpg(1)
