<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Container Base Image Provenance — API Reference

## cosign Image Verification

```bash
# Verify image signature
cosign verify image:tag --certificate-identity id --certificate-oidc-issuer issuer

# Verify attestation
cosign verify-attestation --type slsaprovenance image:tag

# Download signature
cosign download signature image:tag
```

## crane Registry Inspection

```bash
# Get image manifest
crane manifest image:tag | jq '.'

# Get image digest
crane digest image:tag

# Get image config
crane config image:tag | jq '.'

# List tags
crane ls registry/image
```

## trivy Image Scanning

```bash
# Full vulnerability scan
trivy image --format json image:tag

# Critical only
trivy image --severity CRITICAL image:tag

# OS packages only
trivy image --vuln-type os image:tag

# SBOM generation from image
trivy image --format cyclonedx image:tag
```

