镜像签名（如 Cosign + Harbor）的核心价值是：证明镜像没被篡改，且确实来自你信任的来源。

1. 安装 Cosign

wget https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64

sudo mv cosign-linux-amd64 /usr/local/bin/cosign

sudo chmod +x /usr/local/bin/cosign

cosign version

2. 生成密钥对

cosign generate-key-pair

会生成： cosign.key — 私钥（妥善保管） cosign.pub — 公钥

3. 推送镜像（若尚未推送）

docker login harbor.example.com

docker pull nginx:latest

docker tag nginx:latest harbor.example.com/library/nginx:v1.0

docker push harbor.example.com/library/nginx:v1.0

4. 用 Cosign 签名

# 按镜像 tag 签名
cosign sign --yes  --key cosign.key  --new-bundle-format=false  --use-signing-config=false   harbor.example.com/library/nginx:v1.0

5. 验证签名

cosign verify --key cosign.pub harbor.example.com/library/nginx:v1.0

Web UI 刷新后，「已签名」应变为 ✅。

6. 开启镜像扫描

cd /opt/harbor
vim harbor.yml

确保Trivy 段已开启

trivy:
  ignore_unfixed: false
  skip_update: false
  skip_java_db_update: false
  offline_scan: false
  security_check: vuln
  insecure: false
  timeout: 5m0s

重新 prepare 并带上 Trivy

sudo docker compose down

sudo ./prepare --with-trivy

sudo docker compose up -d

确认 Trivy 已注册

7. 下载Trivy离线资源包，关闭在线检查，避免网络问题无法访问 ghcr.io

wget https://github.com/web-starbucket/Trivy/releases/download/2026-06-28/trivy.zip

unzip grivy.zip 

cp /data/harbor/registry/trivy-adapter/trivy

trivy:
  ignore_unfixed: false
  skip_update: true
  skip_java_db_update: true
  offline_scan: true
  security_check: vuln
  insecure: false
  timeout: 5m0s

sudo docker compose down

sudo ./prepare --with-trivy

sudo docker compose up -d