Signed image without a prior build scan found

Rule Details

Cortex AppSec Rule ID	APPSEC-ATTEST-2
Category - Subcategory	Artifact Integrity Validation - Attestation Lifecycle Failure
Severity	HIGH

Impact

An image was signed via cortex-cli attest sign without a corresponding build-image asset in the Unified Asset Inventory (UAI). A build-image asset is created when a Cortex-CLI scan is performed on the image. Signing without a prior scan means the signature cannot be correlated to a build-image asset, breaking the scan-to-signature provenance chain and allowing an unscanned (and therefore unverified) artifact to carry a trusted signature.