Question

A financial services company runs its container build pipeline in Cloud Build, pushing images to Artifact Registry. Auditors require cryptographic proof of how each image was built, including the source commit and build steps, so that downstream Binary Authorization policies can verify that images originate only from the trusted pipeline. The security team wants to enable this evidence with minimal custom tooling. What should they do?

Accepted Answer

Enable build provenance generation in Cloud Build so it produces SLSA-compliant provenance metadata for each image, and configure a Binary Authorization policy that requires attestations validated against that provenance.

Answer

Write a custom Cloud Function that hashes each built image and stores the hash in a BigQuery table for auditors to query manually.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry and rely on the CVE findings as proof of build origin.

Answer

Sign each image manually with a Cloud KMS asymmetric key from a developer workstation before pushing to Artifact Registry.