csnoob

How can we trust the image if we don't know what is inside? An sbom says what packages are installed but what is in the packages?

Alpine/debian packages show you the code that compiles the package from source, do you have that as well?

Is the cli open source? What about the images themselves?

An easy comparison is wolfi, which is completely open source.