diff --git a/README.md b/README.md index 64688c3..2cd98d9 100644 --- a/README.md +++ b/README.md @@ -21,8 +21,10 @@ While the images are regularly kept up to date it is strongly recommended running `pacman -Syu` right after starting a container due to the rolling release nature of Arch Linux. -All the images, with the exception of the official DockerHub library image, are signed by using [cosign's keyless signing](https://docs.sigstore.dev/cosign/openid_signing/). The images can be verified with one of the following commands: -``` +All the images, with the exception of the official DockerHub library image, are +signed by using [cosign's keyless signing][openid-signing]. The images can be +verified with one of the following commands: +```sh $ cosign verify docker.io/archlinux/archlinux:latest --certificate-identity=https://gitlab.com/archlinux/archlinux-docker@refs/heads/master --certificate-oidc-issuer=https://gitlab.archlinux.org | jq . $ cosign verify quay.io/archlinux/archlinux:latest --certificate-identity=https://gitlab.com/archlinux/archlinux-docker@refs/heads/master --certificate-oidc-issuer=https://gitlab.archlinux.org | jq . $ cosign verify ghcr.io/archlinux/archlinux:latest --certificate-identity=https://gitlab.com/archlinux/archlinux-docker@refs/heads/master --certificate-oidc-issuer=https://gitlab.archlinux.org | jq . @@ -97,6 +99,8 @@ Development images are uploaded to our [quay-containers]: https://quay.io/repository/archlinux/archlinux [ghcr-containers]: https://github.com/archlinux/archlinux-docker/pkgs/container/archlinux +[openid-signing]: (https://docs.sigstore.dev/cosign/openid_signing/) + [self]: https://gitlab.archlinux.org/archlinux/archlinux-docker [in-tree-CI]: https://gitlab.archlinux.org/archlinux/archlinux-docker/-/blob/master/.gitlab-ci.yml