Can we create verifiable checksums for our dockerBuild images?

[sxa]

Our docker build images which are created from the files in https://github.com/adoptium/infrastructure/tree/master/ansible/docker are created via mechanisms described in https://github.com/adoptium/infrastructure/blob/master/FAQ.md#what-about-the-builds-that-use-the-dockerbuild-tag

Once created those images are uploaded to dockerhub, and then where applicable they are downloaded and used on nodes with the dockerBuild tag.

This issue is to cover whether we can store checksums of the docker images prior to upload to give us the ability to verify that they have not been tampered with while being uploaded to, or retrieved from, GitHub.

[zdtsw]

Guess we can get the checksum right after build
docker inspect <image> | jq .[0].Digest but how do we want to store and consume these?