用于多平台图像发布的Docker公证客户端成功，但标记不受信任

我一直在密切关注动作脚本中的步骤(https://github.com/sudo-bot/action-docker-sign/blob/main/action.yml)信任并签署多平台形象。唯一需要的修改是提取SHA256，其中我提取了清单推送命令返回的最后一个SHA256（动作脚本中的cut命令似乎没有返回有效的SHA256）；可能清单推送结果已更改。我还尝试了推送返回的不同SHA256值，结果相同。

这是一个脚本，使用Docker 23.0.0和Ubuntu上安装的sudo apt-get notary公证包。

脚本完成时没有错误，但最后没有图像标记签名。我错过了什么？您如何信任和签署多平台图像标签？

注意，buildx不帮助签署多平台映像；据我所知，它只是推送未签名的图像。

export DOCKER_CONTENT_TRUST=1

# build for platforms, authentication build args omitted; needs docker 23.0.0
docker build --platform=linux/amd64 --tag mydockerid/test-amd64:$(tag)$(tagSuffix) --file $(Folder)/Dockerfile .
docker build --platform=linux/arm64 --tag mydockerid/test-arm64:$(tag)$(tagSuffix) --file $(Folder)/Dockerfile .

export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE='$(SignerKeyPassword)'
docker trust key load $(signerKey.secureFilePath)

export NOTARY_TARGETS_PASSPHRASE='$(TargetKeyPassword)'
export NOTARY_SNAPSHOT_PASSPHRASE='$(SnapshotKeyPassword)'

# Sign and push platform specific images - is it necessary to sign these?
docker trust sign mydockerid/test-amd64:$(tag)$(tagSuffix)
docker trust sign mydockerid/test-arm64:$(tag)$(tagSuffix)

# Create manifest list from platform manifests
docker manifest create mydockerid/test:$(tag)$(tagSuffix) mydockerid/test-amd64:$(tag)$(tagSuffix) mydockerid/test-arm64:$(tag)$(tagSuffix)

# orignal action command does not extract valid SHA
# SHA_256=$(docker manifest push mydockerid/test:$(tag)$(tagSuffix) --purge | cut -d ':' -f 2)

# Push manifest
MANIFEST=$(docker manifest push mydockerid/test:$(tag)$(tagSuffix) --purge)
# Extract last sha256 return by push command which is the only sha256 not corresponding to layers
echo "MANIFEST: ${MANIFEST}"
SHA_256=$(echo ${MANIFEST//*:})          
echo "SHA_256: $SHA_256"

MANIFEST_FROM_REG="$(docker manifest inspect "mydockerid/test:$(tag)$(tagSuffix)" -v)";
echo "MANIFEST_FROM_REG: $MANIFEST_FROM_REG"

# Determine byte size as per action script
BYTES_SIZE="$(printf "${MANIFEST_FROM_REG}" | jq -r '.[].Descriptor.size' | uniq)";
echo "BYTES_SIZE: $BYTES_SIZE"

REF="mydockerid/test"
TAG="$(tag)$(tagSuffix)"
AUTH_BASIC=$(SignerAuthBasic)
ROLE_CLI=""
# Check that keys are present
notary key list -d $(DOCKER_CONFIG)/trust/
# Encode user:pat as base 64
export NOTARY_AUTH="$(printf "${AUTH_BASIC}" | base64 -w0)";
TRUST_FOLDER="$(DOCKER_CONFIG)/trust/"
echo "TRUST_FOLDER: $TRUST_FOLDER"
# publish and sign
notary -d ${TRUST_FOLDER} -s "https://notary.docker.io" addhash "${REF}" "${TAG}" "${BYTES_SIZE}" --sha256 "${SHA_256}" ${ROLE_CLI} --publish --verbose
notary -s "https://notary.docker.io" list "${REF}";
unset NOTARY_AUTH;

脚本完成时没有错误。

notary ... --publish ...命令返回：

Addition of target "1.1.1234-beta" by sha256 hash to repository "***/test" staged for next publish.
Auto-publishing changes to ***/test
Successfully published changes for repository ***/test

最后一个notary ... list命令按预期列出图像标记：

NAME             DIGEST            SIZE (BYTES)    ROLE
----             ------            ------------    ----
1.0.1234-beta    91e75e43bd....    637             targets

但在检查信托时，没有签名：

docker trust inspect --pretty mydockerid/test

No signatures for mydockerid/test


List of signers and their keys for mydockerid/test

....