Vouching for Docker Images - Shopify

This post introduces Binary Authorization for Kubernetes and explains how Shopify uses Voucher, an open-source signing service, to sign Docker images after security checks. It details the concepts of code signing, hashing, public/private keys, and how Binary Authorization, Grafeas, and Kritis work together. Voucher's role as the signing service is highlighted, including its ability to perform custom security checks and integrate with GitHub approvals. The post also announces Voucher's move into the Grafeas project.