Browsing Tags and Pull History

The customer portal shows which images your licenses let you pull, and every pull made with your organization's tokens.

Browsing Tags

On a license's page, each repository has a Browse tags link. The repository page lists the tags you can pull, newest first:

Only what your licenses allow. The list applies the same rules the registry does when you pull. If you hold several active licenses that cover the repository, you see every tag any of them allows. Expired, pending and cancelled licenses don't count.
Platforms are listed for multi-platform images (for example linux/amd64, linux/arm64).
Updated is when the registry last recorded the tag pointing at its image.
Copy pull copies docker pull for the tag. Expand a tag to see its digest and a pull-by-digest command, which always fetches exactly that image even if the tag moves later.

The list is built from what the registry has recorded about each push. A tag that was never recorded (rare) won't appear here, but you can still pull it if your license allows it.

Signatures, SBOMs, and Attestations

Tags show a badge when your vendor has attached something to the image:

Signed: a signature (cosign or Notation) is attached.
SBOM: a software bill of materials (SPDX or CycloneDX) is attached.
Attestation: another attached artifact, such as provenance or a BuildKit attestation.

A badge means the artifact is attached. It doesn't mean Breakwater has checked it. Verify a signature yourself with your vendor's public key; the expanded tag gives the commands, pinned to the digest each artifact is attached to:

cosign verify --key vendor.pub registry.breakwaterapp.com/vendor-name/product@sha256:...
oras discover registry.breakwaterapp.com/vendor-name/product@sha256:...

Attachments on a multi-platform image are often attached to each platform's image rather than the index, so the commands are grouped by what they're attached to. See Helm Charts and OCI Artifacts for more.

Pull History

Pull history in the sidebar lists every image pulled with your organization's tokens, newest first: when, which image, which token, and the client's IP address and user agent. Filter by token, repository or date.

Use it to check that a token is still in use before revoking it, to spot a token used from somewhere unexpected, and to see which versions you actually run. On the Tokens page, a token's Last used time links to its pulls.

What counts as a pull:

Each successful fetch of an image manifest is one row. imagePullPolicy: Always adds a row every time a pod starts, and cosign verify adds one too.
Pulling a multi-platform image by tag shows two rows: the tag, then the platform image by digest.
A pull by digest shows the digest (and its platform, if it's one platform of a multi-platform image).
Fetching attached signatures and SBOMs doesn't count, and failed pulls aren't recorded.
A token's Last used time changes on any sign-in, including docker login, so a token can be recently used with no pulls.