使用podman artifact就要有Registry，Registry產品有Harbor、GitLab、Docker Hub等。若沒安裝Registry，可以在把本地快取當Registry操作。

[appuser@ certs]$ ls
a2a-proxy.crt  a2a-proxy.key
# 1. 僅在本地打包憑證（不需要 Registry）
[appuser@ certs]$ podman artifact add my-local-certs:v1 a2a-proxy.crt a2a-proxy.key 
b363135afa476dbc287c1d6dddfd9abdcd28da70b7c7ea738b0d5d8c023d02d2
# 2. 查看本地已有的構件
[appuser@ certs]$ podman artifact ls
REPOSITORY      TAG         DIGEST        SIZE
my-local-certs  v1          b363135afa47  3.075kB
[appuser@ certs]$ mkdir bak
# 3. 在本地直接提取到另一個目錄，所以事先建一個子目錄bak
[appuser@ certs]$ podman artifact extract my-local-certs:v1 bak
[appuser@ certs]$ ls bak
a2a-proxy.crt  a2a-proxy.key

但若想要測registry的push或pull，本機還是要建一個Registry。先在本機安裝Docker版的Registry：podman pull docker.io/library/registry。
若開發環境不能上網，就得從本機匯出registry.tar再scp到開發環境匯入。

podman save -o registry.tar docker.io/library/registry
scp ./register.tar appuser@RedHatIP:.
# 登入RedHat主機並匯入
ssh appuser@RedHatIP
podman load -i registry.tar

以下用Registry操作push

# 1. 在本地啟動一個Registry容器（監聽5000 port）
[appuser@ certs]$ podman run -d -p 5000:5000 --name local-registry docker.io/library/registry

# 2. 打包憑證，路徑指向本地localhost:5000
[appuser@ certs]$ podman artifact add localhost:5000/myproject/certs:v1.0 a2a-proxy.crt a2a-proxy.key
b363135afa476dbc287c1d6dddfd9abdcd28da70b7c7ea738b0d5d8c023d02d2

# 3. 推送到這個本地 Registry（--tls-verify=false 是因為本地測試通常沒有SSL憑證）
[appuser@ certs]$ podman artifact push --tls-verify=false localhost:5000/myproject/certs:v1.0
Getting image source signatures
Copying blob 4c6f33b7f9be done   | 
Copying blob 769d9006bfbe done   | 
Copying config 44136fa355 done   | 
Writing manifest to image destination

# 4.1 驗證Registry裡的certs:v1.0是否註冊？用podman artifact inspect
[appuser@ ~]$ podman artifact inspect localhost:5000/myproject/certs:v1.0
{
     "Manifest": {
          "schemaVersion": 2,
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "config": {
               "mediaType": "application/vnd.oci.empty.v1+json",
               "digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
               "size": 2,
               "data": "e30="
          },
          "layers": [
               {
                    "mediaType": "text/plain; charset=utf-8",
                    "digest": "sha256:4c6f33b7f9beed4c01a70268a77830eb10817a43a0c42081f56d9262cc975c04",
                    "size": 1371,
                    "annotations": {
                         "org.opencontainers.image.title": "a2a-proxy.crt"
                    }
               },
               {
                    "mediaType": "text/plain; charset=utf-8",
                    "digest": "sha256:769d9006bfbe5c87e815a8bd4abe67c64721a7fbef4a49f5b22e223805b9102a",
                    "size": 1704,
                    "annotations": {
                         "org.opencontainers.image.title": "a2a-proxy.key"
                    }
               }
          ]
     },
     "Name": "localhost:5000/myproject/certs:v1.0",
     "Digest": "sha256:b363135afa476dbc287c1d6dddfd9abdcd28da70b7c7ea738b0d5d8c023d02d2"
}

# 4.2 驗證Registry裡的certs:v1.0是否註冊？用curl
[appuser@ ~]$ curl -s http://localhost:5000/v2/myproject/certs/tags/list
{"name":"myproject/certs","tags":["v1.0"]}

# 4.3 驗證Registry裡的certs:v1.0是否註冊？用curl，等同用podman artifact inspect
[appuser@ ~]$ curl -s -H "Accept: application/vnd.oci.image.manifest.v1+json" \
     http://localhost:5000/v2/myproject/certs/manifests/v1.0
{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.empty.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2,"data":"e30="},"layers":[{"mediaType":"text/plain; charset=utf-8","digest":"sha256:4c6f33b7f9beed4c01a70268a77830eb10817a43a0c42081f56d9262cc975c04","size":1371,"annotations":{"org.opencontainers.image.title":"a2a-proxy.crt"}},{"mediaType":"text/plain; charset=utf-8","digest":"sha256:769d9006bfbe5c87e815a8bd4abe67c64721a7fbef4a49f5b22e223805b9102a","size":1704,"annotations":{"org.opencontainers.image.title":"a2a-proxy.key"}}]}

從Registry pull下來並解開構件：

# 1. 拉取構件
[appuser@ ~]$ podman artifact pull --tls-verify=false localhost:5000/myproject/certs:v1.0

# 2. 驗證已pull下來，在第二行，第一行是用本機快取。
[appuser@ ~]$ podman artifact ls
REPOSITORY                      TAG         DIGEST        SIZE
my-local-certs                  v1          b363135afa47  3.075kB
localhost:5000/myproject/certs  v1.0        b363135afa47  3.075kB

# 3. 將裡面的憑證檔（crt/key）提取到所在目錄
[appuser@ ~]$ podman artifact extract localhost:5000/myproject/certs:v1.0 .

# 4. 顯示extract後的內容
[appuser@ ~]$ ls -l a2a-proxy*
-rw-r--r--. 1 appuser appuser      1371 Sep  2 13:35 a2a-proxy.crt
-rw-r--r--. 1 appuser appuser      1704 Sep  2 13:35 a2a-proxy.key