Is there any way you can force it to use only software that’s crypographically signed (not hashes)?

My understanding is that nix uses a mix of source-based packages that are automatically pulled without verifying the sources crypgographically.

Can I install nix securely (eg with apt) to run inside the free CI runners provided by GitHub, GitLab, and Codeberg?

Thanks. I haven’t looked into podman much. It came up in our research, but I saw cosign in the docs and assumed it had the same vulnerabilities. I’d be curious of how to use podman with GPG (and assume you’re talking about the publishers signing the release, not me signing it?)

Do you have any examples of popular, public images that you can use with podman, and verify the signature with GPG? Do you have any link to any guide that shows how to do this?