image admission: block uploading images to zot if signature verification fails

[rchincha]

zot is cosign-compatible [1]. However zot is only a transit point for images (accept all images) and signing and verification is left to pushers and pullers. Can we setup zot so that if can reject images which fail verification? This just needs the public key of the signers.

[1] https://github.com/sigstore/cosign

[andaaron]

We would need a configuration to specify 1 global public key, and 1 public key / 1 repo for verification. We also need a way to enable this feature or disable it globally or per repo.

We would allow an image to be uploaded, and expect a signature to be uploaded shortly afterwards. If the signature is not uploaded, the image would be deleted.

[rchincha]

Put this under a "pkg/extensions/sign" with its own extension config.

[andaaron]

We'll reconsider this in the future. For now the client will do all verification.