4 ms·

Particularly interesting given that some of these problems were pointed out to Docker folks ~4 months ago in the development of the feature. https://github.co

• efuquen 12y ago
  Read through that thread, funny thing is 19 days ago someone is pointing out how the docs are misleading after he is informed that docker doesn't verify signatures [1]. @shykes makes the claim on one of the comments here that nobody has every brought up that particular issue before, and while he wasn't the one who responded to this guy someone from the docker core team did. Clearly nobody changed anything in the docs to clarify. Like most things security related people don't care until there is a major exploit or somebody with enough clout complains enough, or more likely than not both. [1]: https://github.com/docker/docker/issues/8093#issuecomment-65612835 https://github.com/docker/docker/issues/8093#issuecomment-65...
  • thaJeztah 12y ago
    Not disputing that the "verified" message is misleading, but the comment you referred to was about "not yet being able to create a signed image". I don't think there's anything yet in the docs with regard to signed image, apart for the release notes[1] mentioning it being a "sneak peak" of a coming feature, that is under development [1]: https://docs.docker.com/v1.3/release-notes/#new-features https://docs.docker.com/v1.3/release-notes/#new-features