Sigstore

• Image verification

  Gate a rollout on container image signatures — cluster ImageVerificationPolicies verify each image with cosign keyless identity and pin it to its digest before a stage applies it.

• Verifying releases

  Verify the signed container image, release archives, and stagesetctl CLI before you run them.