Docker
You're viewing a free preview. Sign in free to read every script.
Why this exists Two questions decide how fast you can respond to a supply chain incident, and most teams cannot answer either: 1. "What is inside this image?" When a new critical vulnerability is announced in a library…
Image SBOM and Signing: CycloneDX with Trivy, Sign and Verify by Digest with cosign
Generate a software bill of materials for an image, sign an image digest with a private key, and verify the signature before deploying, run against a real registry, including a tag that someone re-pushed to a different image and a signing script that refuses tags.
Sign in free to read this script, along with the rest of the library.
Sign in free