SBOM, Scan, Sign: Catch a Swapped Container Image with syft, grype and cosign
In my previous post, I took a container image apart with curl. One thing from it stayed with me: a tag is just a name for a manifest digest, and anyone who can push can move it to another image. Think about what this means for a deployment. It pulls shop:1.0 and runs whatever the tag points to right now. If someone with a push token builds their own shop:1.0 and pushes it over ours, nothing looks different. The same name, the same tag, the same log line on start-up. ...