Verify Dynatrace Operator image and SBOM

Verify Dynatrace Operator image signature

The procedure you need to verify the image signature varies depending on the Dynatrace Operator version you're running.

Dynatrace Operator version 0.11.0+

1. Install Cosign.

2. Select one of the following options.

   Use public key verificationUse keyless verification

   bashcopydownload
   cosign verify --key https://github.com/Dynatrace/dynatrace-operator/releases/download/<version>/cosign.pub dynatrace/dynatrace-operator:<version>

   bashcopydownload
   cosign verify --certificate-identity=https://github.com/Dynatrace/dynatrace-operator/.github/workflows/publish-images.yaml@refs/tags/<version> --certificate-oidc-issuer=https://token.actions.githubusercontent.com  dynatrace/dynatrace-operator:<version>

Dynatrace Operator version 0.10.4 or earlier

1. Install Cosign.

2. Select one of the following options:

   Use public key verificationUse keyless verification

   bashcopydownload
   cosign verify --insecure-ignore-tlog=true --key https://github.com/Dynatrace/dynatrace-operator/releases/download/<version>/cosign.pub dynatrace/dynatrace-operator:<version>

   Dynatrace Operator version 0.9.0+

   bashcopydownload
   cosign verify --certificate-identity=https://github.com/Dynatrace/dynatrace-operator/.github/workflows/publish-images.yaml@refs/tags/<version> --certificate-oidc-issuer=https://token.actions.githubusercontent.com  dynatrace/dynatrace-operator:<version>

Check the Software Bill of Materials (SBOM)

Dynatrace Operator version 0.12.0+

To check the Software Bill of Materials (SBOM) of a Dynatrace Operator image, use Cosign to verify the attestation and retrieve the signed SBOM.

1. Install Cosign.

2. Run the following command to get the signed SBOM.

   bashcopydownload
   cosign verify-attestation \
   --certificate-identity=https://github.com/Dynatrace/dynatrace-operator/.github/workflows/release.yaml@refs/tags/<version> \
   --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
   --type cyclonedx docker.io/dynatrace/dynatrace-operator:<version> \
   | jq -r .payload | base64 -d | jq -r .predicate > sbom.json

   This creates the file sbom.json in your local file system with the SBOM of the operator image.