What does signing a container image actually prove?
We're signing our built images, but that doesn't tell us whether the base image or dependencies were trustworthy before the build. How are people verifying those inputs, and…
We're signing our built images, but that doesn't tell us whether the base image or dependencies were trustworthy before the build. How are people verifying those inputs, and…