[post policy provider refactoring] Investigate restrictions on verifications happen to all attached artifacts/signatures

[binbin-li]

What would you like to be added?

Currently we're in progress of refactoring policy provider to offload policy decision to OPA engine. That would require Ratify iterate through all artifacts/signatures to generate all reports even though we might need only 1 successful verified signature. Right now we have all verification happen in parallel which might minimize the ovarall duration of each request, but it will definitely incur huge computing/network overhead.

We'll evaluate the impact on Ratify once the refactoring is done, this issue is mainly for reminding for now.

Anything else you would like to add?

No response

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.