Keys

• RPM-GPG-KEY-evalgo
• evalgo-images.pub

RPM key

RPM-GPG-KEY-evalgo, fingerprint 496F 7E15 C10B FCDE 474D 6869 9C76 3426 E71D 3482. Signs every RPM and the repository metadata (gpgcheck=1, repo_gpgcheck=1), and the catalog checksums of RPM versions (SHA256SUMS.asc).

Image key

evalgo-images.pub (ECDSA P-256, cosign format). Signs every image (sigstore attachment), its SBOM and security attestations, and the catalog checksums of image versions (SHA256SUMS.sigstore.json). There is no transparency log entry: the key alone is the trust anchor, hence --insecure-ignore-tlog=true when verifying.

To make podman and bootc refuse unsigned images, /etc/containers/policy.json:

{"default": [{"type": "reject"}],
 "transports": {"docker": {"registry.evalgo.org/evalgo": [{"type": "sigstoreSigned",
   "keyPath": "/etc/pki/containers/evalgo-images.pub", "signedIdentity": {"type": "matchRepository"}}]},
   "containers-storage": {"": [{"type": "insecureAcceptAnything"}]}}}

and /etc/containers/registries.d/evalgo.yaml:

docker:
  registry.evalgo.org:
    use-sigstore-attachments: true