Your release team needs every container image built by Cloud Build to carry a verifiable record of its source commit, the builder used, and the build steps, so a later admission policy can check where the image came from. What should the build configuration enable?
Show answer and explanation
Answer: C
Cloud Build can record provenance describing the source revision, the builder, and the steps used to create an image. The record is stored as a SLSA-style attestation alongside the artifact, and Binary Authorization can then require it before deployment.
Why the other options are wrong
- A. Disabling logs removes an audit trail rather than creating a verifiable record, and it produces no attestation of how the image was built.
- B. Mutable latest tags point to whatever was pushed last, so they say nothing about how an image was built or from which source.
- D. A manual build on a laptop leaves no reliable, tamper-resistant build record, so an admission policy could not verify the image's origin.