DET-R2: Unsigned image pushed to a watched repository¶
An image was pushed to a repository the registry policy watches and no signature for its digest followed within the grace period.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Image registry |
| Group | supply |
| Log source | CloudTrail · ECR |
| Related check | REG-SIG-01: Artifact is signed |
Fires when¶
an image pushed to a watched repository has no valid signature
How it runs¶
untrust registry detect --policy <trust policy> reads registry audit events for the repositories the policy watches.
This rule needs:
untrust registry detect --grace: Minutes a push may wait for its signature before DET-R2 calls it unsigned.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.