Immutable Tag

An immutable tag is permanently pinned to a specific content digest (e.g., SHA256 hash) rather than a mutable pointer. Once set, the registry rejects any push operation that attempts to overwrite the tag with a different manifest. This guarantees that model:v1.0 always resolves to the exact same bytes, eliminating time-of-check to time-of-use (TOCTOU) vulnerabilities in deployment pipelines.

• Prevents tag mutation attacks where a compromised CI pipeline replaces a known-good artifact.
• Enables deterministic deployments across geographically distributed clusters.
• Forms the basis for non-repudiation in model provenance chains.

To support immutable tags, mature registries implement a quarantine-first promotion model. Artifacts are initially pushed to ephemeral, non-immutable tags (e.g., model:staging-abc123) for scanning and validation. Only after passing all binary authorization checks—including vulnerability scans and signature verification—is the artifact promoted by attaching a permanent, immutable tag.

• Decouples the build act from the release act.
• Ensures no artifact reaches production without passing a centralized policy engine.
• Prevents cryptographic downgrade attacks by enforcing signature checks before promotion.

Because an immutable tag is permanently bound to a content digest, it creates an unalterable historical record. Combined with a transparency log like Rekor, every tag assignment is cryptographically attested and publicly auditable. An auditor can traverse the log to verify that no artifact was retroactively substituted, establishing a chain of custody from build to deployment.

• Enables retroactive verification of all production deployments.
• Supports SLSA Level 3 compliance by providing non-falsifiable provenance.
• Integrates with Rekor transparency logs for public auditability.

Immutable tag policies are critical in air-gapped environments where external revocation checks are impossible. In a disconnected sovereign cloud, a model's integrity must be guaranteed locally. Immutable tags, combined with a local Hardware Security Module (HSM) for key management, ensure that artifacts transferred via one-way data diodes cannot be tampered with after ingestion.

• Supports WORM (Write-Once-Read-Many) storage models for regulatory compliance.
• Prevents insider threats in physically isolated network segments.
• Works natively with ORAS for transferring model weights and SBOMs across air gaps.

The ultimate expression of immutability is bypassing tags entirely and referencing artifacts directly by their content digest (model@sha256:abc...). This practice eliminates the tag abstraction layer and guarantees that every node in the deployment chain is operating on a cryptographically precise artifact. Immutable tags serve as a human-readable alias for this digest-based workflow.

• Eliminates dependency confusion attacks in multi-stage builds.
• Ensures byte-for-byte reproducibility across dev, staging, and production.
• Required for high-assurance Binary Authorization enforcement in Kubernetes.