docs: document kit signing and verification - #25791
Conversation
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The new Sign and verify kits section is clear, well-structured, and follows the Docker documentation style guide. No style violations, AI-isms, or content accuracy issues were found in the added lines.
The section covers:
- Keyless and key-based signing/verification flows with correct command syntax
- OCI referrer storage and the combined push-and-sign workflow
- ZIP kit limitation (no verifiable signatures)
- Trusted signer policy setup with both keyless and key-based examples
- Accurate description of the signed-content boundary and its mutable-dependency caveat
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The new "Sign and verify kits" section is well-structured and covers keyless signing, key-based signing, OCI referrer storage, and signature enforcement policy. No high or medium issues found. Three minor low-severity observations are noted as inline comments.
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The new Sign and verify kits section is well-structured, technically clear, and free of AI-isms, marketing language, and broken Markdown. No high or medium severity issues were found.
A few minor observations (below the threshold for inline comments):
- Line ~476: The relative clause
content that install and startup commands downloadis slightly hard to parse. Considercontent fetched by install and startup commands. - Line ~452:
OIDCappears in CLI flags butOpenID Connectis never introduced with the abbreviation in prose. A first-use expansion (e.g.,OpenID Connect (OIDC) issuer) would help readers connect the concept to the flag.
The kits guide did not cover the Sigstore signing support added in docker/sandboxes#4446. Document keyless and key-based workflows, OCI sign-on-push, signature enforcement, and the signed-content boundary. Co-Authored-By: Claude <noreply@anthropic.com>
a5a8a7a to
72b51b8
Compare
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
3 participants
Summary
Document Sigstore signing and verification for kits, including keyless and key-based workflows, OCI sign-on-push, trusted signer enforcement, and the signed-content boundary. This covers the functionality introduced by docker/sandboxes#4446.
@netlify /ai/sandboxes/customize/kits/
Deploy preview
Generated by Codex