Artifact Registry
Inspect image digests, tags, and multi-platform contents in the repositories used by your deployments.
Read the image at its digest
Proofline lists Docker images in selected repositories within one project and location. The evidence includes immutable digests, current tags, size, upload time, and the reported manifest type.
Optional index-manifest collection reads an index by digest and verifies the returned bytes before recording the platform manifests it contains.
Check a changed deployment image
A release that changes its image reference may also change the available platform manifests. Registry evidence gives the review an image record to inspect alongside the workload’s configuration.
Tags describe a mapping at collection time. They do not become permanent image identities, and the presence of an image in the registry does not prove that a service is running it.
Connect the Google Cloud source
Choose the environment, project, and resources in the Google Cloud connection form. Review and apply its setup script, then verify the connection before using its evidence in a review.
Get started with GitHub