<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Container Image Provenance — API Reference

## cosign CLI

```bash
cosign sign --key cosign.key IMAGE
cosign verify --key cosign.pub IMAGE
cosign sign IMAGE  # keyless OIDC
cosign attest --predicate FILE --type TYPE --key cosign.key IMAGE
cosign verify-attestation --key cosign.pub --type TYPE IMAGE
```

## Kyverno Image Verification

| Field | Type | Description |
|-------|------|-------------|
| `verifyImages[].imageReferences` | list | Image glob patterns |
| `verifyImages[].attestors[].entries[].keys.publicKeys` | string | PEM public key |
| `validationFailureAction` | string | Enforce or Audit |

## syft SBOM Generation

```bash
syft IMAGE -o spdx-json > sbom.json
syft IMAGE -o cyclonedx-json > sbom.json
syft dir:./app -o spdx-json
```
