Distributing and verifying authenticity of virtual macahine images and virtual machine image reposiroty using digital signature based on signing policy

1. A computer-implemented method for distributing and verifying authenticity of virtual machine images using digital signatures, the computer-implemented method comprising:

dividing, by a computer, a virtual machine image into a plurality of chunks based on operating system pages of the virtual machine image;

representing, by the computer, the plurality of chunks of the virtual machine image as a graph, each chunk of the plurality of chunks is represented as a node in the graph and an edge between two nodes in the graph represents a dependency between two chunks represented by the two nodes;

signing, by the computer, the graph representing the plurality of chunks of the virtual machine image with a first digital signature;

receiving, by the computer, a request for the virtual machine image from a client hypervisor;

responsive to receiving the request for the virtual machine image, identifying, by the computer, whether a virtual machine image repository is authentic, wherein the virtual machine image repository contains the virtual machine image;

responsive to identifying that the virtual machine image repository is authentic, determining, by the computer, a particular type of the first digital signature to send with the virtual machine image based on a signing policy that includes one or more rules used to determine a specific signing scheme; and

responsive to determining the particular type of the first digital signature to send with the virtual machine image, sending, by the computer, the virtual machine image and the first digital signature of that particular type to the client hypervisor that provisions a virtual machine to execute using the virtual machine image.

2. The computer-implemented method of claim 1 , wherein the virtual machine image repository is identified as authentic by verifying a second digital signature that corresponds to the virtual machine image repository.

3. The computer-implemented method of claim 2 , further comprising:

further responsive to identifying that the virtual machine repository is authentic, identifying, by the computer, whether the virtual machine image is authentic.

4. The computer-implemented method of claim 3 , wherein the virtual machine image is identified as authentic by verifying the first digital signature that corresponds to the graph representing the plurality of chunks of the virtual machine image.

5. The computer-implemented method of claim 1 , wherein the particular type of the first digital signature is selected from a group consisting of an existing digital signature of the graph representing the plurality of chunks of the virtual machine image, a redacted digital signature of the graph representing the plurality of chunks of the virtual machine image, an aggregated digital signature of the graph representing the plurality of chunks of the virtual machine image, and a sanitized digital signature of the graph representing the plurality of chunks of the virtual machine image.

6. A computer program product for distributing and verifying authenticity of virtual machine images using digital signatures, the computer program product comprising a computer readable hardware storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:

divide, by the computer, a virtual machine image into a plurality of chunks based on operating system pages of the virtual machine image;

represent, by the computer, the plurality of chunks of the virtual machine image as a graph, each chunk of the plurality of chunks is represented as a node in the graph and an edge between two nodes in the graph represents a dependency between two chunks represented by the two nodes;

sign, by the computer, the graph representing the plurality of chunks of the virtual machine image with a first digital signature;

receive, by the computer, a request for the virtual machine image from a client hypervisor;

identify, by the computer, whether a virtual machine image repository is authentic in response to receiving the request for the virtual machine image, wherein the virtual machine image repository contains the virtual machine image;

determine, by the computer, a particular type of the first digital signature to send with the virtual machine image based on a signing policy that includes one or more rules used to determine a specific signing scheme in response to identifying that the virtual machine image repository is authentic; and

send, by the computer, the virtual machine image and the first digital signature of that particular type to the client hypervisor that provisions a virtual machine to execute using the virtual machine image in response to determining the particular type of the first digital signature to send with the virtual machine image.

7. The computer program product of claim 6 , wherein the virtual machine image repository image is identified as authentic by verifying a second digital signature that corresponds to the virtual machine image repository.

8. The computer program product of claim 7 , further comprising:

identify, by the computer, whether the virtual machine image is authentic in further response to identifying that the virtual machine repository is authentic.

9. The computer program product of claim 8 , wherein the virtual machine image is identified as authentic by verifying the first digital signature that corresponds to the graph representing the plurality of chunks of the virtual machine image.

10. The computer program product of claim 6 , wherein the particular type of the first digital signature is selected from a group consisting of an existing digital signature of the graph representing the plurality of chunks of the virtual machine image, a redacted digital signature of the graph representing the plurality of chunks of the virtual machine image, an aggregated digital signature of the graph representing the plurality of chunks of the virtual machine image, and a sanitized digital signature of the graph representing the plurality of chunks of the virtual machine image.

11. A computer for distributing and verifying authenticity of virtual machine images using digital signatures, the computer comprising:

a bus;

a hardware storage device connected to the bus, wherein the hardware storage device stores program instructions; and

a processor connected to the bus, wherein the processor executes the program instructions to:

divide a virtual machine image into a plurality of chunks based on operating system pages of the virtual machine image;

represent the plurality of chunks of the virtual machine image as a graph, each chunk of the plurality of chunks is represented as a node in the graph and an edge between two nodes in the graph represents a dependency between two chunks represented by the two nodes;

sign the graph representing the plurality of chunks of the virtual machine image with a first digital signature;

receive a request for the virtual machine image from a client hypervisor;

identify whether a virtual machine image repository is authentic in response to receiving the request for the virtual machine image, wherein the virtual machine image repository contains the virtual machine image;

determine a particular type of the first digital signature to send with the virtual machine image based on a signing policy that includes one or more rules used to determine a specific signing scheme in response to identifying that the virtual machine image repository is authentic; and

send the virtual machine image and the first digital signature of that particular type to the client hypervisor that provisions a virtual machine to execute using the virtual machine image in response to determining the particular type of the first digital signature to send with the virtual machine image.

12. The computer of claim 11 , wherein the virtual machine image repository is identified as authentic by verifying a second digital signature that corresponds to the virtual machine image repository.

13. The computer of claim 12 , wherein the processor further executes the program instructions to:

identify whether the virtual machine image is authentic in further response to identifying that the virtual machine repository is authentic.

14. The computer of claim 13 , wherein the virtual machine image is identified as authentic by verifying the first digital signature that corresponds to the graph representing the plurality of chunks of the virtual machine image.