Massimo Prencipe

Alpine doesn't automatically create API keys for teams, it's parametrized: https://github.com/stevespringett/Alpine/blob/master/alpine-infra/src/main/java/alpine/persistence/AlpineQueryManager.java#L559 Dependency-Track invokes the inherited AlpineQueryManager#createTeam method with the "true" parameter which generates the API key: https://github.com/DependencyTrack/dependency-track/blob/master/src/main/java/org/dependencytrack/resources/v1/TeamResource.java#L135 The simplest fix...

Sure, I can raise a PR.

Can they be configured to only allow images signed e.g. by a service in an on-prem environment?