DevSecOps intermediate
Attestations and Provenance: Binding the SBOM to the Image
Turn the SBOM from part 2 into a Cosign attestation bound to the image digest, verify it and read the predicate back, list what hangs off an image with cosign tree, and see what SLSA build provenance adds.