Appendix: disconnected transfer planning

Use this reference to plan the evidence and artifacts that must cross a network boundary. The workshop cluster remains connected. The optional preparation below gathers public verification material and saved evidence; a destination verification exercise would also need the actual image and its signatures.

Module 5.3 adds and verifies the admission signing key. That exercise uses the connected registry and is complete without this appendix.

Prepare an immutable image and verification evidence then transfer the required artifacts and verify at the destination

Define the transfer set

Item Why it matters

Image manifest and layers

The destination needs the artifact identified by the approved digest. A text file containing that digest is a reference, not an image transfer.

Image signatures and relevant attestations

Copy the verification artifacts using a method supported by the source and destination registries. Confirm that copying the image also preserves the required signatures.

Admission public key

For the workshop key-based signature, use the public key published in tssc-admission/lab-cosign-pubkey. Keep the private signing key at its authorized source.

Keyless trust and verification material

Plan the trusted roots, certificate identity and issuer policy, and transparency-log evidence required by the destination verifier. A copied TUF root alone is not a complete offline verification package.

Matching SBOM and advisories

Carry the inventory for the same digest and the advisory versions used in the assessment, with their identifiers and retrieval dates.

Transfer record

Record source and destination references, digests, package checksums, verification results, and the responsible reviewer.

Choose the destination verification method before packaging. Its trust policy and tool version determine which materials are needed. Also plan dependency repositories, advisory refresh, certificate rotation, and the approval process for later transfers.

Optional: gather the workshop’s public evidence

Run this after Tracks 5–7 if you want a local example of an evidence package. The commands copy the saved promoted image reference and retrieved SBOM, then export only the admission public key. They do not copy image layers or signatures and do not perform a physical transfer.

Success means the folder contains a digest-pinned reference, a nonempty public key, and a CycloneDX inventory for that digest. Stop if any file is missing or the comparison fails.

DROP="$(mktemp -d "$HOME/media-drop.XXXXXX")"
cp ~/lightwell-compliance-evidence/promoted-image.txt "$DROP/image.txt"
cp ~/lightwell-compliance-evidence/tpa-app-sbom.json "$DROP/sbom.cyclonedx.json"
oc -n tssc-admission get configmap lab-cosign-pubkey \
  -o jsonpath='{.data.cosign\.pub}' > "$DROP/cosign.pub"
test -s "$DROP/cosign.pub"
IMAGE="$(cat "$DROP/image.txt")"
DIGEST="${IMAGE##*@}"
printf '%s\n' "$IMAGE" | grep -Eq '@sha256:[0-9a-f]{64}$'
jq -e --arg digest "$DIGEST" \
  '.bomFormat == "CycloneDX" and .metadata.component.version == $digest' \
  "$DROP/sbom.cyclonedx.json"
ls -l "$DROP"

Keep the directory outside your application repository. Add the saved destination signature-verification output and advisory evidence only after checking that they refer to this image. Do not include tokens, passwords, or cosign.key.

Verify at the destination

A real transfer procedure should demonstrate the following sequence:

  1. Import the image and its verification artifacts into the destination registry.

  2. Compare the destination digest with the approved source digest.

  3. Verify the signature with the destination’s trusted key or identity policy.

  4. Compare the inventory and advisory evidence with that verified artifact.

  5. Record the outcome before making the image available for deployment.

Test under the destination’s actual network restrictions. A verification that still reaches the source registry or online trust services does not demonstrate an offline workflow. Follow the documentation for the selected verifier when assembling and testing offline bundles.

Related references