Package & Artifact Identity
Packages and distribution artifacts must maintain immutable identities and cryptographic integrity.
Invariants
- Cryptographic Checksums: SHA256 checksums generated and verified for all distribution artifacts.
- Immutable Digests: Container references resolve to immutable
@sha256:...digests rather than mutable tags. - Digital Signatures: Binaries and images signed using tools like Cosign.