WS-2026-0058

crossplane-runtime's xpkg.CachedClient.Get resolved a package tag to a digest with fetcher.Head, had cosign verify that digest, and then re-fetched the image by the original tag - so the verified digest and the pulled bytes came from two independent registry requests. A registry serving different...