gnuplusmatt

oci repositories support signing artifacts, container trust policies are a thing. bootc repos are both signed and are distro repos, ostree Fedora and ublue are using it

Just because quay.io or hub.docker can be accessed without signatures or trust doesn’t mean there aren’t repos out there using it.

trusting an oci repository is the same as trusting a distro repository, if its a dodgey unknown you got from got knows where and you cant verify, dont use it