Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[3.0][NodeJS] Document signature verification for azurelinux/base/nodejs images

Aperta
  • Qualcosa non va?
#19,419 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, node.js
Ambito
documentation, security

Direzione di ricerca

Start with the Azure Linux container image documentation for mcr.microsoft.com/azurelinux/base/nodejs and the exact linux/amd64 digest in the issue. Identify first party trust material and verification guidance for this image family, then document the requested signature, policy, attestation, tag, and support details with authoritative references. Done means a reader can verify that exact image digest and understand its artifact and image support lifecycle.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

3.0 documentation

Where is the documentation issue?

The Azure Linux container-image documentation for mcr.microsoft.com/azurelinux/base/nodejs, including the Azure Linux 3 Node 24 image line.

What is wrong or missing?

We are evaluating this public linux/amd64 image as a build input for a disposable, non-production Azure credential proof:

mcr.microsoft.com/azurelinux/base/nodejs:24.18@sha256:7480a3a10b15446e17528a1e51c41fccc49bbb25c0a7d5347e59aaee29756728

MCR's OCI referrers endpoint exposes an application/vnd.cncf.notary.signature artifact with digest sha256:d92d3574072ff180d82692d1f0159cc4bd201543f76609df0b431e97b133cab25 for that exact platform manifest, but we could not locate authoritative publisher trust material needed to verify it.

Referrer discovery alone does not establish the signer identity or trusted certificate chain. Verification material documented for another Microsoft product family cannot safely be inferred for Azure Linux.

Suggested fix

Please document, or confirm here with first-party references:

  1. the supported verification tool and minimum/exact version for this image family;
  2. the signature envelope/format used by the discovered Notary artifact;
  3. the trusted root/intermediate certificate chain and official download locations;
  4. the exact accepted signer identity or X.509 subject for azurelinux/base/nodejs;
  5. a strict Notation trust-policy example scoped to mcr.microsoft.com/azurelinux/base/nodejs;
  6. whether RFC 3161 timestamp verification or revocation checking is required and the corresponding trust material;
  7. how to retrieve and cryptographically verify an SBOM and provenance for the exact linux/amd64 digest;
  8. whether signatures and attestations remain available when the moving 24.18 tag advances; and
  9. the support and patch lifecycle for the Node 24 Azure Linux 3 image line.

Azure Linux version, if applicable

Azure Linux 3.0 / Node.js 24.

Additional context

We will not treat referrer discovery, a tag-level vulnerability report, or verification material for another Microsoft product family as evidence for this digest. This request contains only public image references and public artifact digests; no subscription, tenant, registry credential, database or environment information is required.

Lingua principale
Python
Stelle
5.4k
Fork
711
Merge medio
1g 8h
PR unite (30g)
527

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/azurelinux

Tutte le issue di microsoft/azurelinux

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.