A Docker image reference is composed of an optional registry host and a repository name, with optional tag or digest components. Repository-level signing and registry-based distribution are therefore identified through the repo and registry portions of an image reference. A trusted publisher is a content classification, while a base layer is image content rather than an image identifier.
Community Discussion