After pushing a verified build of inspections-api to OCIR, the team must cryptographically bind that particular push to a key they manage. What is the documented OCIR signing approach?
Select an answer to reveal the explanation.
Short Explanation
Signing happens after the image is in OCIR: Container Registry CLI binds that push’s image OCID to a Vault master key. Multiple keys can sign the same image; cluster enforcement is a later concern.
Full Explanation
Official OCIR image signing creates a signature that binds a particular push (the image OCID) to a master encryption key from OCI Vault. Signing is performed after push using the Container Registry CLI; multiple keys may sign the same image. This item is the registry action. Cluster-side admission enforcement and Vault key-rotation procedures are separate topics.