Question

Your security team requires that every container image built by your Cloud Build pipelines includes verifiable build provenance so that downstream consumers can confirm the image was produced by your trusted build system and has not been tampered with. You want to minimize custom scripting and use native platform capabilities. What should you do?

Accepted Answer

Enable Cloud Build's built-in SLSA build provenance generation when pushing images to Artifact Registry, and have consumers verify the generated provenance metadata.

Answer

Add a custom build step that computes a SHA-256 digest of the image and writes it to a Cloud Storage bucket for consumers to compare.

Answer

Configure Binary Authorization to sign images at deploy time and store the signatures in Secret Manager for auditors.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry so that scan results serve as proof of image origin.