:_mod-docs-content-type: ASSEMBLY
[id="security-container-signature"]
= Container image signatures
include::_attributes/common-attributes.adoc[]
:context: security-container-signature

toc::[]

[role="_abstract"]
To verify the integrity of the images in the Red Hat Container Registries between Red Hat registries and your infrastructure, you can enable signature verification.

Red Hat delivers signatures for the images in the Red Hat Container Registries. Those signatures can be automatically verified when being pulled to {product-title} 4 clusters by using the Machine Config Operator (MCO).

To verify the integrity of those images between Red Hat registries and your infrastructure, enable signature verification.

//Enabling Signature Verification in OCP
include::modules/containers-signature-verify-enable.adoc[leveloffset=+1]

//Verifying that the enable signature verification is active
include::modules/containers-signature-verify-application.adoc[leveloffset=+1]

//Understanding the verification of container images lacking verifiable signatures
include::modules/containers-signature-verify-unsigned.adoc[leveloffset=+1]

//Using skopeo to verify signatures of Red Hat container images
include::modules/containers-signature-verify-skopeo.adoc[leveloffset=+2]

[id="additional-resources_security-container-signature"]
[role="_additional-resources"]
== Additional resources
* link:https://quay.io/[Quay.io]
* link:https://catalog.redhat.com/software/containers/explore[Red Hat Ecosystem Catalog Container images]
* xref:../../updating/understanding_updates/intro-to-updates.adoc#understanding-openshift-updates[Introduction to OpenShift Updates]
* xref:../../machine_configuration/index.adoc#machine-config-overview[Machine Config Overview]
* link:https://mirror.openshift.com/pub/openshift-v4/signatures/openshift-release-dev/ocp-release/[OpenShift release signatures mirror site]
* link:https://access.redhat.com/security/data/fd431d51.txt[Red Hat GPG release key]
