How to transfer/import Docker images signed with Notation from one container registry to another with signature?

Question

How to transfer/import Docker images signed with Notation from one container registry to another with signature?

Saurabh_Pilankar 0

We have integrated the Notation CLI on our local machine and can successfully sign Docker images, as well as push the signed images to an Azure Container Registry (ACR). However, when we import these signed images from one ACR to another, the Notation signatures are lost. How can we transfer or import signed images between ACRs without losing their Notation signatures?

Michele Ariis 1,960 Reputation points MVP

2025-05-12T10:17:02.43+00:00

Hi @Saurabh_Pilankar , try this:

-With ORAS:

oras copy \

sourceACR.azurecr.io/myapp:1.0 \

targetACR.azurecr.io/myapp:1.0 \

--all-referrers

Copy image + Notation signatures.

-With AZ CLI (preview):

az feature register --name ImportOCIArtifacts --namespace Microsoft.ContainerRegistry

az provider register --namespace Microsoft.ContainerRegistry

az acr import \

--name targetACR \

--source sourceACR.azurecr.io/myapp:1.0 \

--include-referrers true

Then verify with notation verify
Saurabh_Pilankar 0 Reputation points

2025-05-12T11:39:12.4+00:00

It will not work. I tried it

Michele Ariis 1,960 MVP

Hey Saurabh, super quick:

Get image digest

digest=$(az acr repository show-manifests \
  --name sourceACR --repository myapp \
  --query "[?tags[0]=='1.0'].digest" -o tsv)

Get signature digests

sigs=$(az acr repository show-referrers \
  --name sourceACR --repository myapp \
  --digest $digest \
  --query "[?artifactType=='application/vnd.cncf.notation.signature'].digest" -o tsv)

Import the image

az acr import --name targetACR \
  --source sourceACR.azurecr.io/myapp@$digest \
  --repository myapp

Import each signature

for s in $sigs; do
  az acr import --name targetACR \
    --source sourceACR.azurecr.io/myapp@$s \
    --repository myapp
done

Verify

notation verify targetACR.azurecr.io/myapp:1.0

This ensures both the image and its Notation signatures land in your target ACR.

Dharani Reguri 1,175 Reputation points Microsoft External Staff Moderator

2025-05-12T13:16:49.7766667+00:00
Hi Saurabh_Pilankar,

In addition to Michele Ariis, can you please try by running ORAS pull and push commands.

Pull image and signature locally and saves the image files and signature artifact into the local folder.

oras pull sourceacr.azurecr.io/myapp:1.0 --include-signature --output ./myapp

Then push the image and signature to destination registry.

oras push destacr.azurecr.io/myapp:1.0 ./myapp/ --include-signature

Please refer to the document about Push and Pull images with ORAS

Kindly let me know if the steps provided helped resolving the issue.

Thank you.
Sina Salam 22,031 Reputation points Volunteer Moderator

2025-05-12T23:03:55.17+00:00
Hello Saurabh_Pilankar,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand your stress.

Let's focus on these:

To make the target ACR will retain all Notation signatures linked to the image.

Make notation verify confirms integrity and authenticity post-transfer.

And avoids error-prone scripting on manual digest handling.

Follow these steps to ensure signatures are preserved during transfer and use the associated resource links for more details:

Step 1: Activate the ImportOCIArtifacts preview feature:
az feature register --name ImportOCIArtifacts --namespace Microsoft.ContainerRegistry az provider register --namespace Microsoft.ContainerRegistry

Wait for registration (up to 10 minutes). - https://learn.microsoft.com/en-us/azure/container-registry/container-registry-import-images#import-oci-artifacts-preview

Step 2: Use ORAS (v1.1.0+) to copy all referrers:
oras copy \ --all \ sourceACR.azurecr.io/myapp:1.0 \ targetACR.azurecr.io/myapp:1.0
This helps you to Transfer Image + Signatures with ORAS - https://oras.land/docs/cli/commands/copy/

Step 3: Verify the transfer by using Bash command to:

Check signatures in the target ACR: notation list targetACR.azurecr.io/myapp:1.0

Verify signature integrity: notation verify targetACR.azurecr.io/myapp:1.0

For notation verify guide - https://notaryproject.dev/docs/usage/cli/verify/

Step 4: Fallback (Manual Transfer) if ORAS fails, then manually pull and push:

Pull the image and signatures:

oras pull sourceACR.azurecr.io/myapp:1.0 --output ./myapp --include-referrers

Push to the target ACR:

oras push targetACR.azurecr.io/myapp:1.0 ./myapp/ --include-referrers

For ORAS Push/Pull - https://oras.land/docs/how-to/working-with-referrers/

Step 5: Lastly you will need to verify ACR configuration by ensure both ACRs use the Premium SKU, which supports OCI artifacts. https://learn.microsoft.com/en-us/azure/container-registry/container-registry-skus

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.
Saurabh_Pilankar 0 Reputation points

2025-05-13T13:20:45.1+00:00

when I tried to register the ImportOCIArtifacts it throws below error. I logged into the correct tenant and subscription. And oras will not push the image with the signature as it does not support the flag --include-signature
Saurabh_Pilankar 0 Reputation points

2025-05-13T13:21:37.7933333+00:00

Is there any image which signed using notary v2 and pushed to the docker hub registry so that I can see that image from UI only?

2 answers

Your answer

Michele Ariis 1,960 Reputation points MVP

2025-05-12T10:17:02.43+00:00

Hi @Saurabh_Pilankar , try this:

-With ORAS:

oras copy \

sourceACR.azurecr.io/myapp:1.0 \

targetACR.azurecr.io/myapp:1.0 \

--all-referrers

Copy image + Notation signatures.

-With AZ CLI (preview):

az feature register --name ImportOCIArtifacts --namespace Microsoft.ContainerRegistry

az provider register --namespace Microsoft.ContainerRegistry

az acr import \

--name targetACR \

--source sourceACR.azurecr.io/myapp:1.0 \

--include-referrers true

Then verify with notation verify
Saurabh_Pilankar 0 Reputation points

2025-05-12T11:39:12.4+00:00

It will not work. I tried it
Michele Ariis 1,960 Reputation points MVP

2025-05-12T11:50:00.5266667+00:00

Hey Saurabh, super quick:

Get image digest

digest=$(az acr repository show-manifests \ --name sourceACR --repository myapp \ --query "[?tags[0]=='1.0'].digest" -o tsv)

Get signature digests

sigs=$(az acr repository show-referrers \ --name sourceACR --repository myapp \ --digest $digest \ --query "[?artifactType=='application/vnd.cncf.notation.signature'].digest" -o tsv)

Import the image

az acr import --name targetACR \ --source sourceACR.azurecr.io/myapp@$digest \ --repository myapp

Import each signature

for s in $sigs; do az acr import --name targetACR \ --source sourceACR.azurecr.io/myapp@$s \ --repository myapp done

Verify

notation verify targetACR.azurecr.io/myapp:1.0

This ensures both the image and its Notation signatures land in your target ACR.
Dharani Reguri 1,175 Reputation points Microsoft External Staff Moderator

2025-05-12T13:16:49.7766667+00:00

Hi Saurabh_Pilankar,

In addition to Michele Ariis, can you please try by running ORAS pull and push commands.

Pull image and signature locally and saves the image files and signature artifact into the local folder.

oras pull sourceacr.azurecr.io/myapp:1.0 --include-signature --output ./myapp

Then push the image and signature to destination registry.

oras push destacr.azurecr.io/myapp:1.0 ./myapp/ --include-signature

Please refer to the document about Push and Pull images with ORAS

Kindly let me know if the steps provided helped resolving the issue.

Thank you.
Saurabh_Pilankar 0 Reputation points

2025-05-13T13:20:45.1+00:00

when I tried to register the ImportOCIArtifacts it throws below error. I logged into the correct tenant and subscription. And oras will not push the image with the signature as it does not support the flag --include-signature
Saurabh_Pilankar 0 Reputation points

2025-05-13T13:21:37.7933333+00:00

Is there any image which signed using notary v2 and pushed to the docker hub registry so that I can see that image from UI only?

Answer 1

Dharani Reguri 1,175 Microsoft External Staff Moderator

Hi Saurabh_Pilankar,

I tried repro doing in my lab and we can transfer signed images between ACRs without losing their Notation signatures. Here are the steps followed:

I have created two ACRs; one as source ACR and another as Destination ACR and built a simple Docker image and pushed to source ACR.

Before this I generated a Notation signing Key and added a certificate to the trust store and then signed the image with Notation.

I have tried importing image from source ACR to the Destination ACR by following below command:

oras copy -r sourceacr.azurecr.io/sourcerepo:sourcetag destacr.azurecr.io/destrepo:desttag

User's image

Then we can try checking the signature associated with the image by running the command below:

notation ls destacr.azurecr.io/destrepo:desttag

You can also check the portal for the signature associated with the image by navigating to the repository → Referrers → Artifacts. It shows the digest of the signature object.
User's image

Please refer to the documents about promoting the artifact and oras cp command

If it was helpful, please click "Upvote" on this post to let us know.

Thank You.

Prrudram-MSFT 28,201 Reputation points Moderator

2025-05-19T06:31:24.53+00:00

Hi Saurabh_Pilankar,
Did you get a chance to review the above answer. If it helps, please accept answer and upvote where it says "Was it helpful"
Saurabh_Pilankar 0 Reputation points

2025-05-21T06:46:31.13+00:00

@Dharani Reguri Hi, could you please show the path in the target/destination container registry where I can see the signature thumbprint? In the source repository, if you sign the image using Notary, then one artifact is created, and it has a signature thumbprint. As shown in screenshot
Saurabh_Pilankar 0 Reputation points

2025-05-21T10:13:17.05+00:00

I can see the signature from the Azure portal. Will try out your solution and let you know.
Dharani Reguri 1,175 Reputation points Microsoft External Staff Moderator

2025-05-21T10:30:49.1366667+00:00

Hi Saurabh_Pilankar,

Yes, you are correct. If you sign the image using Notary, then one artifact is created, and it has a signature thumbprint. you can check the same with in the Target container registry as well.

Please let me know the updates once you have tried the solution suggested.
Dharani Reguri 1,175 Reputation points Microsoft External Staff Moderator

2025-05-22T09:47:48.6833333+00:00

Hi Saurabh_Pilankar,

Just checking in to see if you have got a chance to try the solution that I have suggested.
Saurabh_Pilankar 0 Reputation points

2025-05-22T10:33:05.17+00:00

Yes it works
Saurabh_Pilankar 0 Reputation points

2025-06-23T12:50:47.03+00:00

@Dharani Reguri is there any other way to transfer the signature instead of using the ORAS tool? any az acr command?

Answer 2

Saurabh_Pilankar 0

@Dharani Reguri The -r flag used in the ORAS command is currently in preview.
https://oras.land/docs/commands/oras_cp

Share via

How to transfer/import Docker images signed with Notation from one container registry to another with signature?

2 answers

Your answer