Why Did Docker Abandon TUF?: A Turbulent History of Container Signing

Introduction While doing a deep dive on Sigstore and TUF, a question hit me out of nowhere. "OK, but how exactly are container images protected from tampering?" If you understand TUF, you'd guess: "You write the container image hash into targets.json, sign it with an offline key, done." And in 201