-
Notifications
You must be signed in to change notification settings - Fork 38
Closed
Description
Now that we have a new extensions framework and a way to route attestations to one or many OCI registries, we should remove the pre-requisite of using the main
OCI registry as storage backend of attestations.
The idea would be to
- Go back to having the attestations (just the envelope) stored in the DB
- Do not send to OCI's main repository
The reasoning for this change is two fold
- There can not be two mechanisms to send attestations to OCI. The extensions framework is the new one and gives more flexibility to our users, so we should leverage it instead.
- The current OCI repository
model
is starting to look more like a CAS storage backend configuration instead. It's how you configure the CAS and it will evolve over time to having more backends.
### Tasks
- [x] Store and consume the envelope from DB
- [x] Remove code that sends attestations to custom OCI repositories
- [ ] Update documentation