Verify Chainguard images in an air-gapped environment

Chainguard signs with keyless (Fulcio/Rekor) identities. There is no downloadable Chainguard public key and no --offline flag. Verify with the certificate-identity flags plus a flag to skip the transparency log.

Public cgr.dev/chainguard/* images:

cosign verify \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity=https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main \
  --insecure-ignore-tlog=true \
  cgr.dev/chainguard/<image>

Private or dedicated-registry images:

cosign verify \
  --certificate-oidc-issuer=https://issuer.enforce.dev \
  --certificate-identity-regexp="https://issuer.enforce.dev/.*" \
  --insecure-ignore-tlog=true \
  cgr.dev/<parent>/<image>

Add --insecure-ignore-sct=true if no certificate-transparency log is reachable. Move images and signatures together with cosign save --dir <d> <image> and cosign load --dir <d>, or with crane copy SRC DST.