+++ This bug was initially created as a clone of Bug #1633482 +++

Description of problem:
The /etc/containers/policy.json file shipped with skopeo-containers does not enable image signature verification. E.g.

$ cat /etc/containers/policy.json 
{
    "default": [
        {
            "type": "insecureAcceptAnything"
        }
    ],
    "transports":
        {
            "docker-daemon":
                {
                    "": [{"type":"insecureAcceptAnything"}]
                }
        }
}


Version-Release number of selected component (if applicable):
skopeo-1:0.1.31-1.dev.gitae64ff7.el7.src

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Once all Red Hat shipped images are signed, a per registry policy could be used to verify Red Hat-only images. E.g.

{
    "default": [{"type": "reject"}],
    "transports": {
        "docker": {
            "access.redhat.com": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
                }
            ]
        },
}


--- Additional comment from Jason Shepherd on 2019-04-16 00:12:43 UTC ---

To be more specific about what is required:

$ cat /etc/containers/policy.json
{
    "default": [
        {
            "type":    "signedBy",
            "keyType": "GPGKeys",
            "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
            "signedIdentity": {"type":"matchExact"}
        }
    ]
}

$ cat /etc/containers/registries.d/redhat.yaml
docker:
    registry.access.redhat.com:
        sigstore: https://access.redhat.com/webassets/docker/content/sigstore

With this configuration container image pulled from registry.access.redhat.com will be verified. For images mirrored on registry.redhat.io Red Hat only started generating valid signatures for them from April 1st, 2019. Until Red Hat publish signatures for images distributed on registry.redhat.io prior to April 1st, 2019 signature validation on images pulled from there won't work.

If you expect to only be pulling images distributed after that date, you can modify registries.d/redhat.yaml like so:

$ cat /etc/containers/registries.d/redhat.yaml
docker:
    registry.access.redhat.com:
        sigstore: https://access.redhat.com/webassets/docker/content/sigstore
    registry.redhat.io:
        sigstore: https://access.redhat.com/webassets/docker/content/sigstore