Supply-Chain

• Image verification

  Gate a rollout on container image signatures — cluster ImageVerificationPolicies verify each image with cosign keyless identity and pin it to its digest before a stage applies it.

• ImageUnverified

  A stage referenced an image that fails an ImageVerificationPolicy; the stage is held before apply.

• Verifying releases

  Verify the signed container image, release archives, and stagesetctl CLI before you run them.