2 ms·

Is this problem also solved by storing software artifacts in OCI container image registries that already support SLSA-compliant TUF signatures?