As a user I can audit existing container images and verify its signatures
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 31
- Forks
- 56
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 22
Description
Author: @ipanova (ipanova@redhat.com)
Redmine Issue: 9581, https://pulp.plan.io/issues/9581
There will be a separate API call that will be provided with the (1) signature verification policy config (2) public keys to verify against (3) content to verify
A follow-up question: what to do in case validation failed? There should be some steps that will take care of removing tempered content. Should this be automatic or a separate manual call?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by reviewing Redmine issue 9581 and the existing API conventions, then resolve the open question about failed validation and remediation. Done means the API requirements clearly cover the verification policy, public keys, content, and failure handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100