internal/

Package bundle parses a PEM certificate bundle and describes what is in it.

Package ccadb answers whether a root is one the browsers still trust for TLS.

Package image pulls a container image and finds the CA bundle inside it, without running the image.

Package lock records what an image is expected to trust, and reports how a later build differs from that record.