{
  "slug": "azure-container-registry-docker-content-trust-retirement",
  "title": "Azure Container Registry: Docker Content Trust retirement",
  "summary": "Retirement date for Docker Content Trust in Azure Container Registry: 31 Mar 2028. On that date the function is removed and the data stored for signing and verifying signatures with it is permanently deleted.",
  "cloud": "azure",
  "service": "Azure Container Registry",
  "service_slug": "container-registry",
  "category": "feature",
  "type": "retirement",
  "announced_date": "2025-03-26",
  "effective_date": "2028-03-31",
  "effective_precision": "day",
  "impact": "Docker Content Trust is completely removed from Azure Container Registry on 31 Mar 2028. Data stored in the registry for signing and verifying signatures with Docker Content Trust is permanently deleted on the same date. Since September 30, 2025, customers have not been able to enable Docker Content Trust on Azure Container Registry. Registries that currently use Docker Content Trust to sign images or verify signatures are affected.",
  "migration_path": "1. Move from Docker Content Trust to the [Notary Project](https://notaryproject.dev/) ecosystem, including its open-source tool [Notation](https://github.com/notaryproject/notation).\n2. For signing, use Azure Key Vault with [self-signed certificates](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-build-push#create-a-self-signed-certificate-azure-cli) or [CA-issued certificates](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-trusted-ca).\n3. To sign in pipelines, see [Sign in ADO pipelines](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign) and [Sign in GitHub workflows](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha).\n4. For verification, see [Verify in ADO pipelines](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign), [Verify in GitHub workflows](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha) and [Verify on AKS](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks).",
  "replacement": "Notary Project (Notation) with Azure Key Vault",
  "affected_versions": [],
  "source_url": "https://azure.microsoft.com/updates?id=485241",
  "extra_source_urls": [
    "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-build-push#create-a-self-signed-certificate-azure-cli",
    "https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-trusted-ca",
    "https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign",
    "https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha",
    "https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha",
    "https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks"
  ],
  "vendor_ref": "485241",
  "last_checked_at": "2026-11-12T09:55:19.345Z",
  "created_at": "2026-11-13T13:36:44.208Z",
  "updated_at": "2026-11-13T13:36:44.208Z",
  "url": "https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement",
  "short_url": "https://eolwatch.dev/i/9e",
  "markdown_url": "https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement.md",
  "json_url": "https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement.json",
  "estate_check": null,
  "source_note": null
}