How we release Kuben: attested, scanned, and built from the bytes we checked
Kuben's release pipeline builds five binaries without a cache, checksums and attests them, builds the image from those exact bytes, scans it before pushing, and embeds a dependency list in every binary. Here is why each step is there.