Spike: Evaluate how to split validating data from validating signatures

[lasomethingsomething]

Objective

• Support the goal of breaking up the image promoter monolith by closely examining the code and describing how we could pursue a more modular design

Steps

• Present a 1-2 page proposal describing the necessary implementation steps and listing pros/cons/tradeoffs. Shouldn't be technical.
  - [ ] Core Problem to be Solved: What should an image have for it to be a candidate for a promotion?
  - [ ] Build provenance attached (signed or unsigned TBD)
  - [ ] Images will have to go through a CVE scanner and certain classes are unacceptable for promotions (examining what "certain classes might be" -- will require SIG Security's involvement)
  - [ ] SBOMs: Do we recommend an SBOM during the promotion process, or not?
• Define the requirement using collected input from SIG Testing, K8s-Infra, Security would be very valuable
• Seek input from SIG members and achieve buy-in so the group can reach consensus and move forward

Context and things to think about while working on this task

• Work is partly dependent upon other research and decisions (see project board)

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[xmudrii]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[xmudrii]

/remove-lifecycle stale

[xmudrii]

I'm not working on this at the moment.
/unassign

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[xmudrii]

/remove-lifecycle stale