Azure Container Registry ContReg1 stores a container image named image1. After enabling content trust, you push two images to ContReg1 as shown. Which of the pushed images are trusted images?

Content trust in Azure Container Registry uses Notary to allow digital signing of images. When content trust is enabled, only images pushed with a digital signature are considered "trusted." In this scenario, image2 was pushed with the --disable-content-trust=false flag, explicitly enabling content trust for that push. This means image2 was digitally signed and is therefore a trusted image. image1 was pushed before content trust was enabled on the registry. Existing images are not retroactively trusted when content trust is enabled; they must be re-pushed with content trust enabled to be signed. image3 was pushed with the --disable-content-trust=true flag. This explicitly disables content trust for that specific push, meaning image3 was not signed and is not a trusted image, even though content trust is enabled on the registry.