goodwithtech · Eljees · Jul 19, 2026
diff --git a/CHECKPOINT.md b/CHECKPOINT.md
@@ -27,7 +27,7 @@ USER dockle
 ### CIS-DI-0002
 **Use trusted base images for containers**
 
-Dockle checks [Content Trust](https://docs.docker.com/engine/security/trust/content_trust/).
+Not supported.
 
 ### CIS-DI-0003
 **Do not install unnecessary packages in the container**
@@ -40,24 +40,6 @@ Not supported.
 Not supported.
 Please check with [Trivy](https://github.com/knqyf263/trivy).
 
-### CIS-DI-0005
-**Enable Content trust for Docker**
-
-> Content trust is disabled by default. You should enable it.
-
-```bash
-$ export DOCKER_CONTENT_TRUST=1
-```
-
-- https://docs.docker.com/engine/security/trust/content_trust/#about-docker-content-trust-dct
-
-    > Docker Content Trust (DCT) provides the ability to use digital signatures for data sent to and received from remote Docker registries.<br/>
-    > Engine Signature Verification prevents the following:
-    >
-    >   - `$ docker container run` of an unsigned image.
-    >   - `$ docker pull` of an unsigned image.
-    >   - `$ docker build` where the FROM image is not signed or is not scratch.
-
 ### CIS-DI-0006
 **Add `HEALTHCHECK` instruction to the container image**
 

diff --git a/README.md b/README.md
@@ -246,8 +246,6 @@ FATAL   - DKL-LI-0001: Avoid empty password
         * No password user found! username : nopasswd
 WARN    - CIS-DI-0001: Create a user for the container
         * Last user should not be root
-INFO    - CIS-DI-0005: Enable Content trust for Docker
-        * export DOCKER_CONTENT_TRUST=1 before docker pull/build
 INFO    - CIS-DI-0008: Confirm safety of setuid/setgid files
         * setuid file: app/suid.txt urw-r--r--
         * setgid file: app/gid.txt grw-r--r--
@@ -303,7 +301,6 @@ $ docker run --rm goodwithtech/dockle:v${DOCKLE_LATEST} [YOUR_IMAGE_NAME]
 | [CIS-DI-0002](CHECKPOINT.md#cis-di-0002) | Use trusted base images for containers | FATAL
 | [CIS-DI-0003](CHECKPOINT.md#cis-di-0003) | Do not install unnecessary packages in the container | FATAL
 | [CIS-DI-0004](CHECKPOINT.md#cis-di-0004) | Scan and rebuild the images to include security patches | FATAL
-| [CIS-DI-0005](CHECKPOINT.md#cis-di-0005) | Enable Content trust for Docker | INFO
 | [CIS-DI-0006](CHECKPOINT.md#cis-di-0006) | Add `HEALTHCHECK` instruction to the container image | INFO
 | [CIS-DI-0007](CHECKPOINT.md#cis-di-0007) | Do not use `update` instructions alone in the Dockerfile | FATAL
 | [CIS-DI-0008](CHECKPOINT.md#cis-di-0008) | Confirm safety of `setuid` and `setgid` files | INFO
@@ -350,8 +347,6 @@ $ dockle goodwithtech/test-image:v1
 ```
 FATAL   - CIS-DI-0001: Create a user for the container
         * Last user should not be root
-WARN    - CIS-DI-0005: Enable Content trust for Docker
-        * export DOCKER_CONTENT_TRUST=1 before docker pull/build
 FATAL   - CIS-DI-0006: Add HEALTHCHECK instruction to the container image
         * not found HEALTHCHECK statement
 FATAL   - CIS-DI-0007: Do not use update instructions alone in the Dockerfile
@@ -405,7 +400,7 @@ $ dockle -f json -o results.json goodwithtech/test-image:v1
   "summary": {
     "fatal": 6,
     "warn": 2,
-    "info": 2,
+    "info": 1,
     "pass": 7
   },
   "details": [
@@ -417,14 +412,6 @@ $ dockle -f json -o results.json goodwithtech/test-image:v1
         "Last user should not be root"
       ]
     },
-    {
-      "code": "CIS-DI-0005",
-      "title": "Enable Content trust for Docker",
-      "level": "INFO",
-      "alerts": [
-        "export DOCKER_CONTENT_TRUST=1 before docker pull/build"
-      ]
-    },
     {
       "code": "CIS-DI-0006",
       "title": "Add HEALTHCHECK instruction to the container image",
@@ -552,15 +539,6 @@ $ dockle -f sarif -o results.json goodwithtech/test-image:v1
                 "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#DKL-LI-0001"
               }
             },
-            {
-              "id": "CIS-DI-0005",
-              "shortDescription": {
-                "text": "Enable Content trust for Docker"
-              },
-              "help": {
-                "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0005"
-              }
-            },
             {
               "id": "CIS-DI-0008",
               "shortDescription": {
@@ -620,13 +598,6 @@ $ dockle -f sarif -o results.json goodwithtech/test-image:v1
             "text": "No password user found! username : nopasswd"
           }
         },
-        {
-          "ruleId": "CIS-DI-0005",
-          "level": "note",
-          "message": {
-            "text": "export DOCKER_CONTENT_TRUST=1 before docker pull/build"
-          }
-        },
         {
           "ruleId": "CIS-DI-0008",
           "level": "note",

diff --git a/pkg/assessor/assessor.go b/pkg/assessor/assessor.go
@@ -6,7 +6,6 @@ import (
 	"github.com/goodwithtech/dockle/pkg/assessor/cache"
 	"github.com/goodwithtech/dockle/pkg/assessor/privilege"
 
-	"github.com/goodwithtech/dockle/pkg/assessor/contentTrust"
 	"github.com/goodwithtech/dockle/pkg/assessor/credential"
 	"github.com/goodwithtech/dockle/pkg/assessor/hosts"
 
@@ -36,7 +35,6 @@ func init() {
 	RegisterAssessor(hosts.HostsAssessor{})
 	RegisterAssessor(credential.CredentialAssessor{})
 	RegisterAssessor(manifest.ManifestAssessor{})
-	RegisterAssessor(contentTrust.ContentTrustAssessor{})
 	RegisterAssessor(cache.CacheAssessor{})
 }
 

diff --git a/pkg/assessor/contentTrust/contentTrust.go b/pkg/assessor/contentTrust/contentTrust.go
diff --git a/pkg/scanner/scan_test.go b/pkg/scanner/scan_test.go
@@ -10,7 +10,6 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 
-	"github.com/goodwithtech/dockle/pkg/assessor/contentTrust"
 	"github.com/goodwithtech/dockle/pkg/assessor/manifest"
 	"github.com/goodwithtech/dockle/pkg/log"
 	"github.com/goodwithtech/dockle/pkg/types"
@@ -44,15 +43,13 @@ func TestScanImage(t *testing.T) {
 				{Code: types.AddHealthcheck, Filename: manifest.ConfigFileName},
 				{Code: types.MinimizeAptGet, Filename: manifest.ConfigFileName},
 				{Code: types.AvoidCredential, Filename: manifest.ConfigFileName},
-				{Code: types.UseContentTrust, Filename: contentTrust.HostEnvironmentFileName},
 			},
 		},
 		"Dockerfile.scratch": {
 			fileName: "./testdata/scratch.tar",
 			expected: []*types.Assessment{
 				{Code: types.AvoidCredential, Filename: "credentials.json"},
 				{Code: types.AddHealthcheck, Filename: manifest.ConfigFileName},
-				{Code: types.UseContentTrust, Filename: contentTrust.HostEnvironmentFileName},
 				{Code: types.AvoidEmptyPassword, Level: types.SkipLevel},
 				{Code: types.AvoidDuplicateUserGroup, Level: types.SkipLevel},
 				{Code: types.AvoidDuplicateUserGroup, Level: types.SkipLevel},

diff --git a/pkg/types/checkpoint.go b/pkg/types/checkpoint.go
@@ -3,7 +3,6 @@ package types
 const (
 	// CIS-DI
 	AvoidRootDefault       = "CIS-DI-0001"
-	UseContentTrust        = "CIS-DI-0005"
 	AddHealthcheck         = "CIS-DI-0006"
 	UseAptGetUpdateNoCache = "CIS-DI-0007"
 	CheckSuidGuid          = "CIS-DI-0008"
@@ -36,7 +35,6 @@ const (
 // DefaultLevelMap save risk level each checkpoints
 var DefaultLevelMap = map[string]int{
 	AvoidRootDefault:       WarnLevel,
-	UseContentTrust:        InfoLevel,
 	AddHealthcheck:         InfoLevel,
 	UseAptGetUpdateNoCache: FatalLevel,
 	CheckSuidGuid:          InfoLevel,
@@ -58,7 +56,6 @@ var DefaultLevelMap = map[string]int{
 // TitleMap save title each checkpoints
 var TitleMap = map[string]string{
 	AvoidRootDefault:                "Create a user for the container",
-	UseContentTrust:                 "Enable Content trust for Docker",
 	AddHealthcheck:                  "Add HEALTHCHECK instruction to the container image",
 	UseAptGetUpdateNoCache:          "Do not use update instructions alone in the Dockerfile",
 	CheckSuidGuid:                   "Confirm safety of setuid/setgid files",