7 files changed, 33 insertions, 20 deletions
diff --git a/cmd/podman/common/create.go b/cmd/podman/common/create.go
index d73fa653f..dad79348d 100644
--- a/cmd/podman/common/create.go
+++ b/cmd/podman/common/create.go
@@ -552,11 +552,6 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
 
 		stopSignalFlagName := "stop-signal"
 		createFlags.StringVar(
-			&cf.SignaturePolicy,
-			"signature-policy", "",
-			"`Pathname` of signature policy file (not usually used)",
-		)
-		createFlags.StringVar(
 			&cf.StopSignal,
 			stopSignalFlagName, "",
 			"Signal to stop a container. Default is SIGTERM",
@@ -702,10 +697,16 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
 			"Write the container process ID to the file")
 		_ = cmd.RegisterFlagCompletionFunc(pidFileFlagName, completion.AutocompleteDefault)
 
-		_ = createFlags.MarkHidden("signature-policy")
 		if registry.IsRemote() {
 			_ = createFlags.MarkHidden("env-host")
 			_ = createFlags.MarkHidden("http-proxy")
+		} else {
+			createFlags.StringVar(
+				&cf.SignaturePolicy,
+				"signature-policy", "",
+				"`Pathname` of signature policy file (not usually used)",
+			)
+			_ = createFlags.MarkHidden("signature-policy")
 		}
 
 		createFlags.BoolVar(
diff --git a/cmd/podman/containers/runlabel.go b/cmd/podman/containers/runlabel.go
index 85f3785be..e60fcbe72 100644
--- a/cmd/podman/containers/runlabel.go
+++ b/cmd/podman/containers/runlabel.go
@@ -70,7 +70,6 @@ func init() {
 	flags.BoolVarP(&runlabelOptions.Pull, "pull", "p", true, "Pull the image if it does not exist locally prior to executing the label contents")
 	flags.BoolVarP(&runlabelOptions.Quiet, "quiet", "q", false, "Suppress output information when installing images")
 	flags.BoolVar(&runlabelOptions.Replace, "replace", false, "Replace existing container with a new one from the image")
-	flags.StringVar(&runlabelOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
 	flags.BoolVar(&runlabelOptions.TLSVerifyCLI, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
 
 	// Hide the optional flags.
@@ -78,8 +77,10 @@ func init() {
 	_ = flags.MarkHidden("opt2")
 	_ = flags.MarkHidden("opt3")
 	_ = flags.MarkHidden("pull")
-	_ = flags.MarkHidden("signature-policy")
-
+	if !registry.IsRemote() {
+		flags.StringVar(&runlabelOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
+		_ = flags.MarkHidden("signature-policy")
+	}
 	if err := flags.MarkDeprecated("pull", "podman will pull if not found in local storage"); err != nil {
 		logrus.Error("unable to mark pull flag deprecated")
 	}
diff --git a/cmd/podman/images/import.go b/cmd/podman/images/import.go
index d4bc0f610..3b6788f4a 100644
--- a/cmd/podman/images/import.go
+++ b/cmd/podman/images/import.go
@@ -77,8 +77,10 @@ func importFlags(cmd *cobra.Command) {
 	_ = cmd.RegisterFlagCompletionFunc(messageFlagName, completion.AutocompleteNone)
 
 	flags.BoolVarP(&importOpts.Quiet, "quiet", "q", false, "Suppress output")
-	flags.StringVar(&importOpts.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
-	_ = flags.MarkHidden("signature-policy")
+	if !registry.IsRemote() {
+		flags.StringVar(&importOpts.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
+		_ = flags.MarkHidden("signature-policy")
+	}
 }
 
 func importCon(cmd *cobra.Command, args []string) error {
diff --git a/cmd/podman/images/load.go b/cmd/podman/images/load.go
index c39ae624e..5cd410f5c 100644
--- a/cmd/podman/images/load.go
+++ b/cmd/podman/images/load.go
@@ -64,8 +64,10 @@ func loadFlags(cmd *cobra.Command) {
 	_ = cmd.RegisterFlagCompletionFunc(inputFlagName, completion.AutocompleteDefault)
 
 	flags.BoolVarP(&loadOpts.Quiet, "quiet", "q", false, "Suppress the output")
-	flags.StringVar(&loadOpts.SignaturePolicy, "signature-policy", "", "Pathname of signature policy file")
-	_ = flags.MarkHidden("signature-policy")
+	if !registry.IsRemote() {
+		flags.StringVar(&loadOpts.SignaturePolicy, "signature-policy", "", "Pathname of signature policy file")
+		_ = flags.MarkHidden("signature-policy")
+	}
 }
 
 func load(cmd *cobra.Command, args []string) error {
diff --git a/cmd/podman/images/pull.go b/cmd/podman/images/pull.go
index a990d1626..2a5fd86cc 100644
--- a/cmd/podman/images/pull.go
+++ b/cmd/podman/images/pull.go
@@ -101,7 +101,6 @@ func pullFlags(cmd *cobra.Command) {
 
 	flags.Bool("disable-content-trust", false, "This is a Docker specific option and is a NOOP")
 	flags.BoolVarP(&pullOptions.Quiet, "quiet", "q", false, "Suppress output information when pulling images")
-	flags.StringVar(&pullOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
 	flags.BoolVar(&pullOptions.TLSVerifyCLI, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
 
 	authfileFlagName := "authfile"
@@ -113,7 +112,10 @@ func pullFlags(cmd *cobra.Command) {
 		flags.StringVar(&pullOptions.CertDir, certDirFlagName, "", "`Pathname` of a directory containing TLS certificates and keys")
 		_ = cmd.RegisterFlagCompletionFunc(certDirFlagName, completion.AutocompleteDefault)
 	}
-	_ = flags.MarkHidden("signature-policy")
+	if !registry.IsRemote() {
+		flags.StringVar(&pullOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
+		_ = flags.MarkHidden("signature-policy")
+	}
 }
 
 // imagePull is implement the command for pulling images.
diff --git a/cmd/podman/images/push.go b/cmd/podman/images/push.go
index a13976612..cf787a71f 100644
--- a/cmd/podman/images/push.go
+++ b/cmd/podman/images/push.go
@@ -101,7 +101,6 @@ func pushFlags(cmd *cobra.Command) {
 
 	flags.BoolVarP(&pushOptions.Quiet, "quiet", "q", false, "Suppress output information when pushing images")
 	flags.BoolVar(&pushOptions.RemoveSignatures, "remove-signatures", false, "Discard any pre-existing signatures in the image")
-	flags.StringVar(&pushOptions.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
 
 	signByFlagName := "sign-by"
 	flags.StringVar(&pushOptions.SignBy, signByFlagName, "", "Add a signature at the destination using the specified key")
@@ -117,7 +116,10 @@ func pushFlags(cmd *cobra.Command) {
 		_ = flags.MarkHidden("remove-signatures")
 		_ = flags.MarkHidden("sign-by")
 	}
-	_ = flags.MarkHidden("signature-policy")
+	if !registry.IsRemote() {
+		flags.StringVar(&pushOptions.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
+		_ = flags.MarkHidden("signature-policy")
+	}
 }
 
 // imagePush is implement the command for pushing images.
diff --git a/cmd/podman/play/kube.go b/cmd/podman/play/kube.go
index 581b29113..11b5d7d34 100644
--- a/cmd/podman/play/kube.go
+++ b/cmd/podman/play/kube.go
@@ -108,8 +108,6 @@ func init() {
 		flags.StringVar(&kubeOptions.CertDir, certDirFlagName, "", "`Pathname` of a directory containing TLS certificates and keys")
 		_ = kubeCmd.RegisterFlagCompletionFunc(certDirFlagName, completion.AutocompleteDefault)
 
-		flags.StringVar(&kubeOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
-
 		seccompProfileRootFlagName := "seccomp-profile-root"
 		flags.StringVar(&kubeOptions.SeccompProfileRoot, seccompProfileRootFlagName, defaultSeccompRoot, "Directory path for seccomp profiles")
 		_ = kubeCmd.RegisterFlagCompletionFunc(seccompProfileRootFlagName, completion.AutocompleteDefault)
@@ -121,7 +119,12 @@ func init() {
 		buildFlagName := "build"
 		flags.BoolVar(&kubeOptions.Build, buildFlagName, false, "Build all images in a YAML (given Containerfiles exist)")
 	}
-	_ = flags.MarkHidden("signature-policy")
+
+	if !registry.IsRemote() {
+		flags.StringVar(&kubeOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
+
+		_ = flags.MarkHidden("signature-policy")
+	}
 }
 
 func kube(cmd *cobra.Command, args []string) error {