Validate ImageBuilder container image signature before use in pipelines

Open
#2,081 1 comment 0 reactions 1 assignee View on GitHub

@lbussell is already working on this.

Since Apr 20, 2026.

Assessment

This issue has not been assessed yet.

Description

area-infrastructure

Currently, pipelines pull the ImageBuilder container image without verifying its signature:

https://github.com/dotnet/docker-tools/blob/9b94edafb9caedd3967fd5efe88a5ca270430353/eng/docker-tools/templates/steps/init-imagebuilder.yml#L34-L42

We should add a notation verify step after pulling the ImageBuilder image to validate that it was signed by Microsoft before using it to build and publish .NET container images.

This will require the Notation CLI, root CA certificates, and a trust policy to be available on the pipeline VM images. Ideally these would be baked into the VM images rather than acquired at pipeline run time, since that is the more secure option and the certificates are long-lived so expiration is not a concern.

Dominant language
C#
Stars
182
Forks
67
Avg merge
1d 20h
Merged PRs (30d)
15

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dotnet/docker-tools

All issues in dotnet/docker-tools

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.