{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/8371","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/8371/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/8371/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/8371/events","html_url":"https://github.com/openshift/origin/pull/8371","id":146289546,"number":8371,"title":"Image Signing","user":{"login":"miminar","id":1478803,"avatar_url":"https://avatars.githubusercontent.com/u/1478803?v=3","gravatar_id":"","url":"https://api.github.com/users/miminar","html_url":"https://github.com/miminar","followers_url":"https://api.github.com/users/miminar/followers","following_url":"https://api.github.com/users/miminar/following{/other_user}","gists_url":"https://api.github.com/users/miminar/gists{/gist_id}","starred_url":"https://api.github.com/users/miminar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miminar/subscriptions","organizations_url":"https://api.github.com/users/miminar/orgs","repos_url":"https://api.github.com/users/miminar/repos","events_url":"https://api.github.com/users/miminar/events{/privacy}","received_events_url":"https://api.github.com/users/miminar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openshift/origin/labels/needs-api-review","name":"needs-api-review","color":"b60205"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":51,"created_at":"2016-04-06T11:50:15Z","updated_at":"2016-05-09T17:03:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/8371","html_url":"https://github.com/openshift/origin/pull/8371","diff_url":"https://github.com/openshift/origin/pull/8371.diff","patch_url":"https://github.com/openshift/origin/pull/8371.patch"},"body":"Allow to add signatures to image objects. They are treated as opaque blobs.\r\n\r\nAdded a new cluster resource `images/signatures`.\r\n\r\nAdded `system:image-signer` role that athorizes to update image signatures.\r\n\r\n*TODOs*:\r\n\r\n- [x] define signature types (e.g. `gpg/base64` or just `base64`).\r\n- [x] decide whether user can update signatures being tagged in the project, he administrates\r\n- [x] write some more tests"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/217924906","html_url":"https://github.com/openshift/origin/pull/8371#issuecomment-217924906","issue_url":"https://api.github.com/repos/openshift/origin/issues/8371","id":217924906,"user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"created_at":"2016-05-09T17:03:36Z","updated_at":"2016-05-09T17:03:36Z","body":"@mtrmac I can definitely see that specifying that a signature is just bytes makes an API that works.  It also makes an API that is virtually impossible for naive clients just wanting to display some helpful information to use.  Being able to interpret a signature enough to provide basic information to all clients about that signature is significantly more valuable.\r\n\r\nI'm not saying that you have to give up your raw bytes, just that for a first class integration I expect to have something better for people to use.  I think it would be a shame for us to say that the only way to successfully interact with this API is to write a full verification suite in every language you're writing a client in to figure out any metadata about it.\r\n\r\nI don't understand the resistance to trying to break the various types of signatures into classes."}}