Examples of fingerprinting checks for docker builds?

[deviantintegral]

At https://taskfile.dev/usage/#using-programmatic-checks-to-indicate-a-task-is-up-to-date it says:

Normally, you would use sources in combination with generates - but for tasks that generate remote artifacts (Docker images, deploys, CD releases) the checksum source and timestamps require either access to the artifact or for an out-of-band refresh of the .checksum fingerprint file.

Two special variables {{.CHECKSUM}} and {{.TIMESTAMP}} are available for interpolation within status commands, depending on the method assigned to fingerprint the sources. Only source globs are fingerprinted.

It's unclear to me how you could use either of those additional variables to fingerprint something like a docker build. So far, we've not done any fingerprinting of jobs that build containers, instead letting docker build... decide what needs to be done.

Could someone share examples of how they are using those variables for out of band refreshes? The best I can think of is using docker build --label to include the checksum. But even then, that wouldn't help in the case where FROM points to a moving tag like latest. I guess you could inspect the image to figure that out. But, this all seems like a lot of work when a fully cached docker build is pretty quick anyways.