build1 publisher
Signed payload's subject binds soit's image to a digest, not directly to its v1.0.0 tag
Reading soit-ai/soit v1.0.0 out of ghcr.io by hand shows how far a container signature reaches. It covers one digest, and the release tag survives as a string in the build predicate that nothing compares for you.
Publishers:dev.to
Reality
- Evidence62
- Adoption20
- Hype gap+25
- Incentives55
- Confidence60