.TH "GCLOUD_ALPHA_CONTAINER_BINAUTHZ" 1



.SH "NAME"
.HP
gcloud alpha container binauthz \- manage attestations for Binary Authorization on Google Cloud Platform



.SH "SYNOPSIS"
.HP
\f5gcloud alpha container binauthz\fR \fIGROUP\fR | \fICOMMAND\fR [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(ALPHA)\fR Binary Authorization is a feature which allows binaries to run on
Google Cloud Platform only if they are appropriately attested. Binary
Authorization is configured by creating a policy.



.SH "EXAMPLES"

This example assumes that you have created a keypair using gpg, usually by
running \f5gpg \-\-gen\-key ...\fR, with \f5Name\-Email\fR set to
\f5attesting_user@example.com\fR for your attestor.

First, some convenience variables for brevity:

.RS 2m
ATTESTING_USER="attesting_user@example.com"
DIGEST="000000000000000000000000000000000000000000000000000000000000abcd"
ARTIFACT_URL="gcr.io/example\-project/example\-image@sha256:${DIGEST}"
ATTESTOR_NAME="projects/example\-project/attestors/canary"
.RE

Export your key's fingerprint (note this may differ based on version and
implementations of gpg):

.RS 2m
gpg \e
    \-\-with\-colons \e
    \-\-with\-fingerprint \e
    \-\-force\-v4\-certs \e
    \-\-list\-keys \e
    "${ATTESTING_USER}" | grep fpr | cut \-\-delimiter=':' \-\-fields 10
.RE

This should produce a 40 character, hexidecimal encoded string. See
https://tools.ietf.org/html/rfc4880#section\-12.2 for more information on key
fingerprints.

Create your attestation payload:

.RS 2m
gcloud alpha container binauthz create\-signature\-payload \e
    \-\-artifact\-url="${ARTIFACT_URL}" \e
  > example_payload.txt
.RE

Create a signature from your attestation payload:

.RS 2m
gpg \e
  \-\-local\-user "${ATTESTING_USER}" \e
  \-\-armor \e
  \-\-clearsign \e
  \-\-output example_signature.pgp \e
  example_payload.txt
.RE

Upload the attestation:

.RS 2m
gcloud alpha container binauthz attestations create \e
  \-\-public\-key\-id=${KEY_FINGERPRINT} \e
  \-\-signature\-file=example_signature.pgp \e
  \-\-artifact\-url="${ARTIFACT_URL}" \e
  \-\-attestor=${ATTESTOR_NAME}
.RE

List the attestation by artifact URL. \f5\-\-format\fR can be passed to output
the attestations as json or another supported format:

.RS 2m
gcloud alpha container binauthz attestations list \e
  \-\-artifact\-url="${ARTIFACT_URL}" \e
  \-\-format=yaml
.RE

.RS 2m
  \-\-\-
  \- |
    \-\-\-\-\-BEGIN PGP PUBLIC KEY BLOCK\-\-\-\-\-
    Version: GnuPG v1
    ... SNIP ...
    \-\-\-\-\-END PGP PUBLIC KEY BLOCK\-\-\-\-\-
  \- |
    \-\-\-\-\-BEGIN PGP SIGNED MESSAGE\-\-\-\-\-
    Hash: SHA1
    ... SNIP ...
    \-\-\-\-\-BEGIN PGP SIGNATURE\-\-\-\-\-
    Version: GnuPG v1
    ... SNIP ...
    \-\-\-\-\-END PGP SIGNATURE\-\-\-\-\-
.RE

List all artifact URLs on the project for which Container Analysis Occurrences
exist. This list includes the list of all URLs with BinAuthz attestations:

.RS 2m
gcloud alpha container binauthz attestations list
.RE

.RS 2m
  \-\-\-
  https://gcr.io/example\-project/example\-image@sha256:000000000000000000000000000000000000000000000000000000000000abcd
  ...
.RE

Listing also works for kind=ATTESTATION_AUTHORITY attestations, just pass the
attestor:

.RS 2m
gcloud alpha container binauthz attestations list \e
  \-\-artifact\-url="${ARTIFACT_URL}" \e
  \-\-attestor=${ATTESTOR_NAME} \e
  \-\-format=yaml
.RE

.RS 2m
  ...
.RE



.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-help.

Run \fB$ gcloud help\fR for details.



.SH "GROUPS"

\f5\fIGROUP\fR\fR is one of the following:

.RS 2m
.TP 2m
\fBattestations\fR

\fB(ALPHA)\fR Create and manage Google Binary Authorization attestations.

.TP 2m
\fBattestors\fR

\fB(ALPHA)\fR Create and manage Google Binary Authorization Attestors.

.TP 2m
\fBcontinuous\-validation\fR

\fB(ALPHA)\fR Manage Binary Authorization Continuous Validation.

.TP 2m
\fBpolicy\fR

\fB(ALPHA)\fR Create and manage Google Binary Authorization policies.


.RE
.sp

.SH "COMMANDS"

\f5\fICOMMAND\fR\fR is one of the following:

.RS 2m
.TP 2m
\fBcreate\-signature\-payload\fR

\fB(ALPHA)\fR Create a JSON container image signature object.


.RE
.sp

.SH "NOTES"

This command is currently in alpha and might change without notice. If this
command fails with API permission errors despite specifying the correct project,
you might be trying to access an API with an invitation\-only early access
allowlist. These variants are also available:

.RS 2m
$ gcloud container binauthz
.RE

.RS 2m
$ gcloud beta container binauthz
.RE