Spike: Evaluate how to split validating data from validating signatures

kubernetes-sigs / promo-tools

Container and file artifact promotion tooling for the Kubernetes project

Apache License 2.0

145 stars 71 forks source link

Open LappleApple opened 10 months ago

LappleApple commented 10 months ago

[ ] Support the goal of breaking up the image promoter monolith by closely examining the code and describing how we could pursue a more modular design

[ ] Present a 1-2 page proposal describing the necessary implementation steps and listing pros/cons/tradeoffs. Shouldn't be technical.
- [ ] Core Problem to be Solved: What should an image have for it to be a candidate for a promotion?
- [ ] Build provenance attached (signed or unsigned TBD)
- [ ] Images will have to go through a CVE scanner and certain classes are unacceptable for promotions (examining what "certain classes might be" -- will require SIG Security's involvement)
- [ ] SBOMs: Do we recommend an SBOM during the promotion process, or not?
[ ] Define the requirement using collected input from SIG Testing, K8s-Infra, Security would be very valuable
[ ] Seek input from SIG members and achieve buy-in so the group can reach consensus and move forward

k8s-triage-robot commented 6 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

xmudrii commented 6 months ago

/remove-lifecycle stale

k8s-triage-robot commented 3 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

xmudrii commented 3 months ago

/remove-lifecycle stale

xmudrii commented 1 month ago

I'm not working on this at the moment. /unassign