Skip to content

Latest commit

 

History

History
97 lines (66 loc) · 4.4 KB

README.md

File metadata and controls

97 lines (66 loc) · 4.4 KB

Cipher/decipher/sign

Docker container to cipher/decipher/sign data (gnupg, openssl...).

Dockerfile Docker Build Docker Stars Docker Pulls Docker Version CII Best Practices OpenSSF Scorecard

Example without using the filesystem

Let's say that you have a file foo.txt in your current working directory that you want to encrypt with a public key age1u9wu5f2eajlqluhra0jx6qxjeyyr2jygh6vguacrp9pd63kljsesam7cg7:

Mac/Linux

cat foo.txt | docker run --rm -i --net=none leplusorg/crypt age --recipient age1u9wu5f2eajlqluhra0jx6qxjeyyr2jygh6vguacrp9pd63kljsesam7cg7 > foo.age

Windows

type foo.txt | docker run --rm -i --net=none leplusorg/crypt age --recipient age1u9wu5f2eajlqluhra0jx6qxjeyyr2jygh6vguacrp9pd63kljsesam7cg7 > foo.age

Example using the filesystem

Same thing, assuming that you have a file foo.txt in your current working directory that you want to encrypt with a public key age1u9wu5f2eajlqluhra0jx6qxjeyyr2jygh6vguacrp9pd63kljsesam7cg7:

Mac/Linux

docker run --rm -t --user="$(id -u):$(id -g)" --net=none -v "$(pwd):/tmp" leplusorg/crypt age --recipient age1u9wu5f2eajlqluhra0jx6qxjeyyr2jygh6vguacrp9pd63kljsesam7cg7 --output /tmp/foo.age /tmp/foo.txt

Windows

In cmd:

docker run --rm -t --net=none -v "%cd%:/tmp" leplusorg/crypt age --recipient age1u9wu5f2eajlqluhra0jx6qxjeyyr2jygh6vguacrp9pd63kljsesam7cg7 --output /tmp/foo.age /tmp/foo.txt

In PowerShell:

docker run --rm -t --net=none -v "${PWD}:/tmp" leplusorg/crypt age --recipient age1u9wu5f2eajlqluhra0jx6qxjeyyr2jygh6vguacrp9pd63kljsesam7cg7 --output /tmp/foo.age /tmp/foo.txt

Software Bill of Materials (SBOM)

To get the SBOM for the latest image (in SPDX JSON format), use the following command:

docker buildx imagetools inspect leplusorg/crypt --format '{{ json (index .SBOM "linux/amd64").SPDX }}'

Replace linux/amd64 by the desired platform (linux/amd64, linux/arm64 etc.).

Sigstore

Sigstore is trying to improve supply chain security by allowing you to verify the origin of an artifcat. You can verify that the jar that you use was actually produced by this repository. This means that if you verify the signature of the ristretto jar, you can trust the integrity of the whole supply chain from code source, to CI/CD build, to distribution on Maven Central or whever you got the jar from.

You can use the following command to verify the latest image using its sigstore signature attestation:

cosign verify leplusorg/crypt --certificate-identity-regexp 'https://github\.com/leplusorg/docker-crypt/\.github/workflows/.+' --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

The output should look something like this:

Verification for index.docker.io/leplusorg/xml:main --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":...

For instructions on how to install cosign, please read this documentation.

Request new tool

Please use this link (GitHub account required) to request that a new tool be added to the image. I am always interested in adding new capabilities to these images.