After pushing a verified build of inspections-api to OCIR, the team must cryptographically bind that particular push to a key they manage. What is the documented OCIR signing approach?
Select an answer to reveal the explanation.
Short Explanation
Signing happens after the image is in OCIR: Container Registry CLI binds that push’s image OCID to a Vault master key. Multiple keys can sign the same image; cluster enforcement is a later concern.
Full Explanation
Documented OCIR image signing binds a particular pushed image to a key the team manages. After inspections-api is in the registry, you create an image signature with the Container Registry CLI, associating that image’s OCID with a Vault master encryption key. The signature is a registry-side attestation of that push, which later admission or verification steps can require—cryptographically tying “this digest/OCID” to “this key,” not merely to tribal trust in the CI log.
Signing the Dockerfile on the laptop before the first FROM line does not create an OCIR image signature for the pushed artifact; OCIR signing is about the image in the registry. Enabling Object Storage bucket encryption protects objects at rest in a bucket; it is not an image signature over an OCIR image OCID. Asking OKE to sign images at pull time without any registry-side signature action reverses the model—pull-time verification consumes signatures that were produced and stored for the image, it does not invent them from nothing.
Exam caveat: signing after push means unsigned intermediate tags can exist—gate promotion on signature creation, not only on a green build. Operational check: push the image, create the signature with the Container Registry CLI against the Vault key, then view the signature metadata for that image OCID in OCIR and confirm verification tooling accepts it before requiring signatures in the cluster.