Digital Signature Verification for K2view Artifacts

This page explains how to verify the digital signatures of K2view Fabric and Studio container images and Fabric packages.

Signature verification allows customers to confirm that an artifact:

• Was produced and signed by K2view
• Has not been modified after release

Verification is performed locally using standard open-source tooling.

How Signature Verification Works

K2view signs the cryptographic digest of each image and package.

A digest is a unique hash that represents the exact contents of an artifact:

• Any change to the artifact produces a different digest
• If the digest changes, signature verification fails

Each image and each package has its own unique signature.
Signatures are not shared across versions or builds.

K2view uses Cosign, an industry-standard signing tool widely adopted in the Kubernetes ecosystem.

Before you begin

Install the following tools on the system where verification will be performed:

• cosign (install guide)
• Docker (or a compatible OCI runtime)
• jq (download jq)

Verifying container image Signatures

How Container Image Verification Works

K2view container images include embedded metadata (image labels) that specify:

• The public key used to sign the image
• The location of the signature bundle for that image

This metadata allows each image to be verified independently.

Step 1: Pull the Image

Pull the container image from the K2view container registry to your local environment.

docker pull <IMAGE_NAME:IMAGE_TAG>
    

Step 2: Export the Image Name and Tag as an Environment Variable

Export the full image name and tag as an environment variable to simplify the verification commands that follow.

export image=<IMAGE_NAME:IMAGE_TAG>
  

Step 3: Calculate the Image Digest

Extract the immutable digest of the image you downloaded.

docker inspect --format='{{.Id}}' "$image" | tr -d '\n' > "digest.txt"
    

Step 4: Inspect Signature Metadata

Inspect the image labels to locate the signature metadata.

signature_bundle="$(docker inspect "$image" | jq -r '.[].Config.Labels["org.opencontainers.image.signature.bundle"]')"
public_key="$(docker inspect "$image" | jq -r '.[].Config.Labels["org.opencontainers.image.signature.key"]')"
    

Step 5: Download Verification Artifacts

Download the public key and signature bundle using the URLs provided in the image labels.

curl -fsS "https://support.k2view.com/signatures/public-keys/${public_key}" -o "pub.key"
curl -fsS "$signature_bundle" -o "signature.bundle"
    

Step 6: Verify the Image Signature

Verify the image digest against the signature bundle using the public key.
A successful verification confirms the image was signed by K2view and has not been modified.

cosign verify-blob --key "pub.key" --bundle "signature.bundle" "digest.txt"
    

Expected Output

Verified OK

Any other output indicates that the image should not be trusted.

Verifying Fabric Package Signatures

How Package Verification Works

Fabric packages do not support embedded metadata.
For this reason, K2view provides additional metadata files alongside each package that specify:

• The public key used to sign the package
• The location of the signature bundle associated with the package

Step 1: Download the Package

Download the Fabric package provided by K2view.

Step 2: Export the Package Name as an Environment Variable

Export the full package name as an environment variable to simplify the verification commands that follow.

export=<PACKAGE_NAME>
  

Step 3: Calculate the Package Digest

Extract the immutable digest of the package you downloaded.

sha256sum "$package" | awk '{print $1}' > "digest.txt"
    

Step 4: Download Verification Artifacts

Download the public key and signature bundle.

curl -fsS "https://support.k2view.com/signatures/bundles/${package}_publickey.json" -o "publickey.json"
public_key_url=$(jq -r '.publicKey' "publickey.json")

curl -fsS "$public_key_url" -o "pub.key"
curl -fsS "https://support.k2view.com/signatures/bundles/${package}_signature.bundle" -o "signature.bundle"
    

Step 5: Verify the Package Signature

Verify the package digest against the signature bundle using the public key.
A successful verification confirms the package was signed by K2view and has not been modified.

cosign verify-blob --key "pub.key" --bundle "signature.bundle" "digest.txt"
    

Expected Output

Verified OK

Any other output indicates that the package should not be trusted.

Verification Results

• Verified OK
  The artifact is authentic and has not been modified.
• Verification failure or error
  The artifact should not be deployed.

If verification fails, stop deployment and contact K2view Support.

Summary

• K2view signs every image and package individually
• Verification is deterministic and customer-controlled
• Any modification invalidates the signature
• This process aligns with modern software supply-chain security practices