Introduction

Every container image distributed via the public registry is signed with a cosign signature and includes a Software Bill of Materials (SBOM) in CycloneDX format as an attestation. The SBOM lists all software components contained in the image, their versions, and the associated dependencies.

The image’s signature can be verified using the provided public key. The SBOM can then be downloaded and viewed locally. This ensures that the components of every image are fully traceable.