[WIP]Support podman image sign

Generate a signature claim for an image using user keyring (--sign-by). The signature file will be stored in simple json format under the default or the given directory (--directory or yaml file in /etc/containers/registries.d/).

Signed-off-by: Qi Wang <qiwan@redhat.com>

2 files changed, 54 insertions, 1 deletions

diff --git a/docs/podman-image-sign.1.md b/docs/podman-image-sign.1.md
new file mode 100644
index 000000000..c4f3c6676
--- /dev/null
+++ b/docs/podman-image-sign.1.md
@@ -0,0 +1,52 @@
+% podman-image-sign(1)
+
+# NAME
+podman-image-sign- Create a signature for an image
+
+# SYNOPSIS
+**podman image sign**
+[**-h**|**--help**]
+[**-d**, **--directory**]
+[**--sign-by**]
+[ IMAGE... ]
+
+# DESCRIPTION
+**podmain image sign** will create a local signature for one or more local images that have
+been pulled from a registry. The signature will be written to a directory
+derived from the registry configuration files in /etc/containers/registries.d. By default, the signature will be written into /var/lib/containers/sigstore directory.
+
+# OPTIONS
+**-h** **--help**
+  Print usage statement.
+
+**-d** **--directory**
+  Store the signatures in the specified directory.  Default: /var/lib/containers/sigstore
+
+**--sign-by**
+  Override the default identity of the signature.
+
+# EXAMPLES
+Sign the busybox image with the identify of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/.
+
+   sudo podman image sign --sign-by foo@bar.com -d /tmp/signatures transport://privateregistry.example.com/foobar
+
+# RELATED CONFIGURATION
+
+The write (and read) location for signatures is defined in YAML-based
+configuration files in /etc/containers/registries.d/.  When you sign
+an image, podman will use those configuration files to determine
+where to write the signature based on the the name of the originating
+registry or a default storage value unless overriden with the -d
+option. For example, consider the following configuration file.
+
+docker:
+  privateregistry.example.com:
+    sigstore: file:///var/lib/containers/sigstore
+
+When signing an image preceeded with the registry name 'privateregistry.example.com',
+the signature will be written into subdirectories of
+/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means
+the signature will be 'read' from that same location on a pull-related function.
+
+# HISTORY
+November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com)
diff --git a/docs/podman-image.1.md b/docs/podman-image.1.md
index 19893dfda..5a0c4e5f9 100644
--- a/docs/podman-image.1.md
+++ b/docs/podman-image.1.md
@@ -27,7 +27,8 @@ The image command allows you to manage images
 | rm       | [podman-rm(1)](podman-rmi.1.md)           | Removes one or more locally stored images.                                     |
 | save     | [podman-save(1)](podman-save.1.md)        | Save an image to docker-archive or oci.                                        |
 | tag      | [podman-tag(1)](podman-tag.1.md)          | Add an additional name to a local image.                                       |
-| trust    | [podman-image-trust(1)](podman-image-trust.1.md)  | Manage container image trust policy.
+| trust    | [podman-image-trust(1)](podman-image-trust.1.md)  | Manage container image trust policy.                                   |
+| sign    | [podman-image-sign(1)](podman-image-sign.1.md)  | Sign an image.                                                            |
 
 ## SEE ALSO
 podman