Description of problem:

Failed to pull images from registry.access.redhat.com with atomic / skopeo after signing them.

Version-Release number of selected component (if applicable):

RHEL 7.7 kernel-3.10.0-1062.el7.x86_64

docker-1.13.1-104.git4ef4b30.el7.x86_64
atomic-1.22.1-29.gitb507039.el7.x86_64
skopeo-0.1.37-3.el7.x86_64


How reproducible:

100%

Steps to Reproduce:


1. Install components `yum -y install atomic docker skopeo`
2. Configure docker to verify signatures

  sed -i 's/signature-verification=false/signature-verification=true/g' -- /etc/sysconfig/docker
  systemctl restart docker


3. Follow our documentation (https://red.ht/36vU1KF) to create the key, export it, configure atomic trust, sign an image in registy.access.redhat.com


Actual results:

Cannot pull images with signature verification on

~~
FATA[0000] Source image rejected: A signature was required, but no signature exists

Traceback (most recent call last):
  File "/usr/bin/atomic", line 185, in <module>
    sys.exit(_func())
  File "/usr/lib/python2.7/site-packages/Atomic/pull.py", line 62, in pull_image
    be.pull_image(self.args.image, remote_image_obj, debug=self.args.debug, assumeyes=self.args.assumeyes, src_creds=src_creds)
  File "/usr/lib/python2.7/site-packages/Atomic/backends/_docker.py", line 348, in pull_image
    policy_filename=trust.policy_filename, src_creds=src_creds)
  File "/usr/lib/python2.7/site-packages/Atomic/util.py", line 454, in skopeo_copy
    return check_call(cmd, env=os.environ)
  File "/usr/lib/python2.7/site-packages/Atomic/util.py", line 214, in check_call
    return subprocess.check_call(cmd, env=env, stdin=stdin, stderr=stderr, stdout=stdout, close_fds=True)
  File "/usr/lib64/python2.7/subprocess.py", line 542, in check_call
    raise CalledProcessError(retcode, cmd)
CalledProcessError: Command '['/usr/bin/skopeo', '--policy=/etc/containers/policy.json', '--debug', 'copy', '--remove-signatures', 'docker://registry.access.redhat.com/rhel7:latest', 'docker-daemon:registry.access.redhat.com/rhel7:latest']' returned non-zero exit status 1
~~

Expected results:

Be able to pull images from registry.access.redhat.com with signature


Additional info: