What specific tool is used to digitally sign Docker images, enabling content trust and allowing for verification of their origin and integrity when pushed to a registry?

The specific command-line tool used to digitally sign Docker images, enabling content trust and allowing for verification of their origin and integrity when pushed to a registry, is `docker trust`. This tool is part of the Docker client and provides the user interface for interacting with Docker Content Trust.

Digitally signing a Docker image means creating a cryptographic signature for it. This signature is generated using a publisher's private key and is tied to the image's unique content identifier, known as its image digest. The purpose of this signature is twofold: to prove the origin of the image by demonstrating it was signed by a specific, trusted publisher, and to ensure its integrity by guaranteeing that the image content has not been altered since it was signed.

`docker trust` relies on Notary, an open-source tool that implements The Update Framework (TUF). Notary serves as the backend infrastructure for Docker Content Trust. It acts as a trusted collection of signing keys and signature data that assert the authenticity and freshness of Docker images. When a user executes `docker trust sign` for an image, the generated cryptographic signature, along with metadata about the signing key, is pushed to a Notary server, which is typically co-located with the Docker image registry.

The process of content trust involves several cryptographic keys (root, targets, snapshot, timestamp keys), which Notary manages to provide robust security guarantees against various attack vectors, including key compromise.

When a consumer pulls a Docker image with Docker Content Trust enabled (by setting the `DOCKER_CONTENT_TRUST=1` environment variable), the Docker client automatically connects to the Notary server. It then verifies the image against the signatures stored by Notary. This verification confirms that the image digest matches a valid signature from a trusted publisher's key managed by Notary, thereby ensuring both the origin (who published it) and integrity (that it hasn't been tampered with) of the image before it is used. The Update Framework (TUF) provides the underlying security specification, detailing how these different keys are managed and rotated to protect against even sophisticated attacks on the signing infrastructure.