How to verify against a self signed registry?

[lmussier]

Note sure about the title but here is my use case.
We have a registry exposing a self signed certificate and the only way we found to be able to verify the image is to do something like :
export SSL_CERT_FILE=/home/lmussier/source/app-signature/ca.crt
Is there another way of doing this?

[FeynmanZhou]

Hi @lmussier ,

Notation does not support a private registry using a self-signed cert yet. There are two workarounds:

• Try to use HTTP with --insecure-registry instead of HTTPS
• Install the root CA as as a trusted root CA. For example, if you are using Notation on a Ubuntu machine, you can follow https://ubuntu.com/server/docs/security-trust-store.

Do you think whether these workarounds work for your use case?