Assemble Image Attestation For Free

A Docker tag is an alias pointing at a manifest (i.e., the name attribute of the component). A layer is unique and only stored once in a repository; however, many manifests are able to reference one layer. A Docker layer, for example, could be a specific operating system referenced by multiple Docker images.

After a container image is built, an attestation can be created to affirm that a required activity was performed on the image such as a regression test, vulnerability scan, or other test. The attestation is created by signing the image's unique digest.

A single manifest is information about an image, such as layers, size, and digest. The docker manifest command also gives users additional information such as the os and architecture an image was built for.

Attestation Manifest Attestation manifests are attached to the root image index object, under a separate OCI image manifest. Each attestation manifest can contain multiple attestation blobs, with all the of the attestations in a manifest applying to a single platform manifest.

Document showing contents and loading sequence of a container.

Attestation is the act of witnessing the signing of a formal document and then also signing it to verify that it was properly signed by those bound by its contents. Attestation is a legal acknowledgment of the authenticity of a document and a verification that proper processes were followed.

You use attestations to authorize specific container images to be deployed on platforms, such as Google Kubernetes Engine (GKE) and Cloud Run. To use attestations, you must require attestations in the appropriate rule of your policy.

The provenance attestations include facts about the build process, including details such as: Build timestamps. Build parameters and environment. Version control metadata. Source code details.