Copy each image, including every platform in its manifest list, to a transferable directory or a customer registry using skopeo copy with the all and preserve-digests options. The digests then match what you published, so signatures and pinned references still work. Check the result with the digest file option.
Definitions
skopeo copy moves images between locations called transports, such as a registry, a local directory or an archive. A manifest list points to one image per platform. A digest is the content hash of a manifest, so if conversion changes the manifest, the digest changes and anything pinned or signed against it no longer matches.
The options that matter
From the skopeo copy manual:
| Option | Effect |
|---|---|
| all | If the source is a manifest list, copy every image in the list and the list itself, not only the one matching the current platform |
| preserve-digests | Keep the original digests and fail if they cannot be kept. It does not change what is copied, so it is often paired with all |
| digestfile | Write the digest of the resulting image after the copy |
| sign-by | Add a simple signing signature using a key ID |
| src-creds and dest-creds | Credentials for the source or destination registry |
| strip-removed-platforms | Changes digests, invalidates the manifest list signature, and requires removing signatures |
The directory transport copies layers into a local folder, which is the natural choice for media you carry across a boundary.
Steps for a vendor bundle
- List the images and exact digests in your release, from your build output.
- For each, run skopeo copy with all and preserve-digests, to a directory transport path, and record the digest file.
- Compare the digest file with your published list. Any difference means a conversion happened.
- Package the folders with a manifest of names and digests and a checksum file, signed with your release key.
- Document how the customer loads them into their registry with the same options and checks the digests again.
Why not just copy one platform
Without all, only the image for the current platform is copied. If a customer runs a different architecture from your build machine, they get the wrong image or none. And the list digest you published will not exist in their registry, so a chart that pins it fails.
Traps
Do not strip platforms to save space unless you accept new digests and say so. Do not rely on a tag. Reference by digest in the chart for offline installs. See Helm install by digest from an OCI registry and air-gapped software updates.
Try it yourself
Click through it at your own pace, or open it full screen. Scan the bundle contents before you ship them.
If you want a second look at what you ship, Safeguard can generate and scan an SBOM and run dependency scanning with reachability analysis, and you can try the free scan.
Quick check
Why did my digest change after copying?
Likely a conversion or platform stripping. Use all with preserve-digests so the copy fails instead of silently changing.
How do I confirm what was produced?
Use the digest file option to write the resulting digest and compare it with the published one.
Sources
Last reviewed: 19 October 2026.
