Learn: Supply Chain
How the platform knows an image is trustworthy — really your code, built by a CI you trust, untampered — and refuses to run anything that isn’t. This is the produce side of the trust story; Policy & Admission is the enforce side.
Audience: platform engineers who own the shared signing pipeline and verify policies. Developers get a real payoff here too, and the surprise is how little they have to do. If you already know cosign and SLSA, skip to the Reference.
Before you start: read Life of a Deployment, and ideally Policy & Admission. Know what an image digest is.
Read in this order
Section titled “Read in this order”- Orientation — trust provenance, not names. The three facts you can read off a real
signed image with one
cosigncommand (keyless signature, SLSA provenance plus SBOM, the repo trust anchor); the thin-caller model, where teams inherit security and can’t weaken it; and verify-at-admission. - Reference — the pipeline, the real
cosigncommands, the trust rule, the verify policies, and the gotchas (signed isn’t the same as safe; a repo rename breaks trust).
Then, to go deeper on the real system
Section titled “Then, to go deeper on the real system”- The enforce half: Policy & Admission. The whole flow: The Life of a Deployment. The threat framing: The Security Model.
- Onboard your app (the thin-caller snippet): the
supply-chain-onboardingskill.