Support copy --sign-by where the needed docker reference and push domain are different.

[sjhx]

A feature proposal.

The scenario is that the image needs to be pushed to one domain e.g. one with write capability which is different to the domain that clients will pull the image from e.g. a read-only mirrored registry.
There could also be different variations on the docker reference (in repository / tag) such that the image can physically transit other system before becoming available for signature verified consumption at the intended destination.

While that can be achieved today with standalone-sign and a temporary directory store, from the documentation "This is primarily a debugging tool, useful for special cases, and usually should not be a part of your normal operational workflow; use skopeo copy --sign-by instead to publish and sign an image in one step."

We are looking for something that is supported as "part of our normal workflow".

I envisage this could be provided using a new option on copy --sign-by such as --docker-reference "client.domain.io/my/product/image:tag" which could perhaps be provided multiple times to create multiple signatures.

[mtrmac]

Thanks for your report.

Yes, this feature does make sense and should be fairly easy to wire up. (I imagine the CLI might be something like --sign-identity, to match the policy.json syntax.)