dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-004

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		 Previous revision
dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-004 [2026/07/17 08:34] – created nick_didodido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-004 [2026/07/30 05:40] (current) – nick_dido
Line 5: Line 5:
 ===== Statement ===== ===== Statement =====
  
-[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL associate a digital signature with an identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]].+[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL generate a [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signature]] for an identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]] and associate the Digital Signature with that Image.
  
-===== Source Statement =====+===== Derived From =====
  
-> The system shall support image signing.+This requirement derives from:
  
-===== Source =====+  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-IMG-004
  
-Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-IMG-004.+The Original Requirement states:
  
-===== Assessment =====+> //[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL perform [[dido:99_annexes:annex-b-terms-and-definitions:i:image_signing|Image Signing]] by generating a [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signature]] for an identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]] and associating the Digital Signature with that Image.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]
  
-The source statement expresses the approved intent but does not provide a fully testable formulation.+FR-IMG-004 removes the introductory phrase **perform Image Signing by** while preserving the required signing behavior and results.
  
-The following Specification, Discipline, and Authoring findings apply: +No other substantive normalization is required.
- +
-  * **The system** does not use the defined system name +
-  * **shall** does not follow the established uppercase normative convention +
-  * **Support** is a weak verb that does not identify the required behavior +
-  * **Image signing** does not identify the Image to which the signature applies +
-  * The source statement does not identify the observable result of the signing operation +
-  * The source statement does not require verification of the resulting signature +
-  * The source statement does not prescribe a signing algorithm, signature format, key-management system, repository, or implementation technology +
- +
-The normalized Statement: +
- +
-  * Replaces **The system** with [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] +
-  * Replaces **support** with the direct behavior **associate** +
-  * Identifies an Image as the subject of the signing operation +
-  * Identifies a digital signature associated with the Image as the required result +
-  * Retains one primary required behavior +
-  * Preserves implementation independence +
- +
-The normalized Statement does not add requirements for signature verification, Image approval, promotion, publication, deployment, or key governance. Separate requirements define those obligations.+
  
 ===== Rationale ===== ===== Rationale =====
  
-A digital signature associated with an identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]] allows an actor or process to evaluate whether the signature corresponds to that Image and an applicable signing identity. +[[dido:99_annexes:annex-b-terms-and-definitions:i:image_signing|Image Signing]] associates an identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]] with a [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signature]] generated for that Image.
- +
-Image signing contributes to: +
- +
-  * Image authenticity evaluation +
-  * Image integrity evaluation +
-  * Identification of the signing identity +
-  * Controlled Image distribution +
-  * Controlled Image promotion +
-  * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] +
-  * [[dido:99_annexes:annex-b-terms-and-definitions:a:auditability|Auditability]] +
-  * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] +
- +
-The signing operation may apply to:+
  
-  * A [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]] +The association allows a separate verification process to determine whether the Digital Signature corresponds to the identified Image and the applicable signing identity.
-  * A [[dido:99_annexes:annex-b-terms-and-definitions:c:container_image|Container Image]] +
-  * Identifying Image metadata +
-  * An Image content digest +
-  * A representation containing the Image and associated metadata+
  
-The applicable architecture and lower-level requirements determine the exact signed representation and signing mechanism.+This requirement governs generation and association of the Digital Signature. Separate requirements govern signature verification, Image approval, promotion, publication, transfer, and deployment.
  
 ===== Applies To ===== ===== Applies To =====
Line 70: Line 34:
  
   * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]   * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_signing|Image Signing]]
   * [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Images]]   * [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Images]]
-  * [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Images]] +  * [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signatures]]
-  * [[dido:99_annexes:annex-b-terms-and-definitions:c:container_image|Container Images]] +
-  * Image identifiers +
-  * Image content digests +
-  * Digital signatures +
-  * Signing identities +
-  * Signing operations +
-  * Image repositories +
-  * Image build workflows +
-  * Image promotion workflows +
-  * [[dido:99_annexes:annex-b-terms-and-definitions:c:ci_cd_pipeline|CI/CD Pipelines]]+
  
 ===== Verification ===== ===== Verification =====
  
-  - Verification SHALL confirm that [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] performs a signing operation for an identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]] +Verification confirms that:
-  - Verification SHALL confirm that the signing operation associates a digital signature with the identified Image +
-  - Verification SHALL confirm that the associated digital signature identifies or references the Image to which it applies+
  
-Verification may include: +  - An identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]] is selected for signing 
- +  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] generates a [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signature]] for the identified Image 
-  * Machine Image signing tests +  - Crucible associates the generated Digital Signature with the identified Image 
-  * Container Image signing tests +  - The associated Digital Signature identifies or references the Image to which it applies
-  * Signature-record inspection +
-  * Image-metadata inspection +
-  * Image-digest comparison +
-  * Signing-log inspection +
-  * Automated [[dido:99_annexes:annex-b-terms-and-definitions:c:ci_cd_pipeline|CI/CD Pipeline]] testing +
- +
-The verification record SHALL identify: +
- +
-  - The signed Image +
-  - The Image identifier +
-  - The signed representation +
-  - The signing operation +
-  - The associated digital signature +
-  - The signing result +
-  - The observed output +
-  - The generated [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] +
- +
-===== Outgoing Traceability ===== +
- +
-This requirement realizes: +
- +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001|MO-001]] +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-005|MO-005]] +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-006|MO-006]] +
- +
-This requirement relates to: +
- +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-001|FR-IMG-001 — Build Virtual Machine Images]] +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-002|FR-IMG-002 — Build Container Images]] +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-003|FR-IMG-003 — Immutable Infrastructure Workflows]] +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-005|FR-IMG-005 — Image Verification]] +
-  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-006|FR-IMG-006 — Image Promotion Workflows]] +
-  * [[dido:02-crusible:06-machine-images-and-image-layers:start|6. Machine Images and Image Layers]] +
-  * [[dido:02-crusible:09-compliance-and-security:start|9. Compliance and Security]] +
-  * [[dido:02-crusible:10-reproducibility-provenance-and-traceability:start|10. Reproducibility, Provenance, and Traceability]]+
  
 ===== Referenced By ===== ===== Referenced By =====
  
-The wiki Backlinks function provides the current list of pages that reference ''FR-IMG-004''.+The following pages reference this requirement:
  
-Incoming [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] should be derived dynamically from backlinks rather than maintained as a duplicate manual list.+{{backlinks>.#dido:02-crusible}}
  
-Backlinks identify incoming references but do not define the semantics of each relationship. Referencing pages should identify whether the relationship represents realization, refinement, verification, dependency, or another defined traceability relationship.+===== Implementation Status =====
  
-===== ConOps Relationship =====+Implemented and Verified
  
-The Crucible Concept of Operations describes a Phase 1 workflow that builds controlled Image [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifacts]] through an automated [[dido:99_annexes:annex-b-terms-and-definitions:c:ci_cd_pipeline|CI/CD Pipeline]].+===== Requirement Status =====
  
-FR-IMG-004 establishes the required signing behavior for an identified Image produced or processed by that workflow.+<todo>Review and approve FR-IMG-004 as a leaf requirement.</todo>
  
-Requirements governing Image building, signature verification, promotion, compliance assessment, publication, transfer, and deployment define separate behavior.+---- 
 +===== Issues =====
  
-===== Delivery Phase =====+<todo>Confirm that the Source Statement reproduces the exact wording of the controlling System Requirements Specification.</todo>
  
-Phase 1 +<todo>Determine whether separate requirements define the signing identity and signing-key requirements.</todo>
- +
-===== Implementation Status ===== +
- +
-Not Assessed +
- +
-Implementation status requires verification that [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] associates a digital signature with an identified [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]]. +
- +
-===== Requirement Status ===== +
- +
-Draft +
- +
-The source System Requirements Specification identifies Version 1.1 as a draft.+
  
 ---- ----
 ===== Notes for Editors ===== ===== Notes for Editors =====
  
-This requirement page should retain the stable requirement identifier ''FR-IMG-004''.+This requirement page retains the stable requirement identifier ''FR-IMG-004''.
  
-Changes to the Statement SHALL preserve the approved intent of the source requirement.+This page is a leaf requirement page and omits a trailing '':start'' from its namespace.
  
-The Source Statement should preserve the original wording from the controlling System Requirements Specification.+The Statement preserves both required results expressed by the Original Requirement:
  
-The Statement should remain limited to associating a digital signature with an identified Image.+  * Generation of a Digital Signature for an identified Image 
 +  * Association of the generated Digital Signature with that Image
  
-Requirements for signature verification, Image approval, promotion, publication, transfer, and deployment should remain in their applicable requirement pages.+Do not reduce the Statement to association alone because doing so would omit the required generation of the Digital Signature.
  
-Verification criteria should test only the behavior stated in the normalized Statement and should not introduce additional normative obligations. +Do not add signature verification, Image approval, promotion, publication, transfer, deployment, signing-algorithm, or key-governance obligations unless the controlling requirement changes through an approved requirements process.
- +
-Incoming Traceability should use the wiki Backlinks function rather than a manually maintained list.+
  
 To reference this requirement Statement from another wiki page, insert: To reference this requirement Statement from another wiki page, insert:
Line 183: Line 89:
 {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-004#Statement&noheader&nofooter&noeditbtn}} {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-004#Statement&noheader&nofooter&noeditbtn}}
 </code> </code>
- 
-Do not rename this page after an external citation unless a redirect or move plan is in place. 
  
 ---- ----
  • dido/02-crusible/99-annexes/annex-c-requirements/03-functional-requirements/03-02-image-management/fr-img-004.1784302488.txt.gz
  • Last modified: 2026/07/17 08:34
  • by nick_dido