Local storage of Signatures

[iamsamirzon]

Summary
The CLI will need access to a local storage
Intended Outcome
Notation CLI implementations allows for this use case
The specfication PR is merged
Additional context
Will update based on finalized design/spec in prior version of alpha release
The implementation work is in #46
Specification work will be in #43

[iamsamirzon]

This is an optimization that we can defer to a RC-2 or later

[iamsamirzon]

Lets talk to @shizhMSFT about this before deciding if this is needed for RC-1

[gokarnm]

• What happens when signatures get deleted in repo?
• What happens when new signature are associated with artifact, will they be pulled?

[iamsamirzon]

The implementation work is in #46
Specification work will be in #43

[dtzar]

Closing as duplicate of #15

[iamsamirzon]

@dtzar - I disagree. This item is not a duplicate of #15. They are related, as #15 may require the capability identified in this item, but the capability itself can be used even in "remote signing" ( aka signing an image that is already present in an OCI repository)

Lets talk to @shizhMSFT if he sees a use case for defining and implementing local storage of signatures outside of "local signing" ( aka #15)

[dtzar]

Ah, I see sorry. Makes sense "local storage of a signature" versus "local signing" if we think there is enough difference which might need to be implemented. I feel like "local storage of a signature" was just a natural thing which needed to happen for "local signing".