FR-IMG-005 — Image Verification

Go to Crucible Image Management Requirements

Statement

Crucible SHALL verify the digital signature associated with an identified Image.

Source Statement

Crucible SHALL perform Digital Signature Verification for the Digital Signature associated with an identified Image.

Source

Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-IMG-005.

Assessment

The source statement expresses the approved intent but does not provide a fully testable formulation.

The following Specification Discipline and Authoring findings apply:

The system does not use the defined system nameshall does not follow the established uppercase normative conventionSupport is a weak verb that does not identify the required behaviorImage verification does not identify what property of the Image is verifiedThe source statement does not identify the observable result of verificationThe source statement does not prescribe a signature algorithm, trust store, certificate mechanism, key-management system, or implementation technologyWithin the surrounding Image Management requirements, FR-IMG-004 establishes Image signing. FR-IMG-005 therefore treats verification as verification of the digital signature associated with an identified Image.

The normalized Statement:

Replaces The system with CrucibleReplaces support with the direct behavior verifyIdentifies the digital signature as the subject of verificationIdentifies the Image associated with the signatureRetains one primary required behaviorPreserves implementation independenceThe normalized Statement does not independently require vulnerability scanning, compliance assessment, functional testing, Image approval, promotion, or deployment validation.

Rationale

Verification of the digital signature associated with an identified Image allows Crucible to determine whether the signature remains valid for the evaluated Image under the applicable verification conditions.

Signature verification can detect:

Modification of signed Image contentA mismatch between an Image and its signatureAn invalid signatureAn unrecognized signing identityA signing identity that does not satisfy the applicable trust conditionsImage verification contributes to:

Image integrity evaluationImage authenticity evaluationControlled Image promotionControlled Image distributionControlled Image deploymentAuditabilityEvidenceTraceabilityA valid digital signature does not by itself establish that the Image:

Is free from vulnerabilitiesSatisfies a compliance baselineIs approved for promotionIs authorized for deploymentIs compatible with a target platformIs suitable for a specified purposeSeparate requirements govern those determinations.

Applies To

This requirement applies to:

Image identifiersImage content digestsDigital signaturesSigning identitiesVerification conditionsVerification operationsImage repositoriesImage promotion workflowsCI/CD Pipelines

Verification

Verification SHALL confirm that Crucible evaluates the digital signature associated with an identified ImageVerification SHALL confirm that Crucible determines whether the evaluated digital signature is valid for the identified ImageVerification SHALL confirm that Crucible records the verification resultVerification may include:

Valid-signature testingInvalid-signature testingModified-Image testingImage-and-signature mismatch testingUnrecognized-signing-identity testingSignature-record inspectionImage-digest comparisonVerification-log inspectionAutomated CI/CD Pipeline testingThe verification record SHALL identify:

The evaluated ImageThe Image identifierThe evaluated digital signatureThe applicable verification conditionsThe verification operationThe verification resultThe observed outputThe generated Evidence

Outgoing Traceability

This requirement realizes:

This requirement relates to:

Referenced By

The wiki Backlinks function provides the current list of pages that reference FR-IMG-005.

Incoming Traceability should be derived dynamically from backlinks rather than maintained as a duplicate manual list.

Backlinks identify incoming references but do not define the semantics of each relationship. Referencing pages should identify whether the relationship represents realization, refinement, verification, dependency, or another defined traceability relationship.

ConOps Relationship

The Crucible Concept of Operations describes a Phase 1 workflow that builds and processes controlled Image Artifacts through an automated CI/CD Pipeline.

FR-IMG-005 establishes the required digital-signature verification behavior for an identified Image processed by that workflow.

Requirements governing Image building, signing, compliance assessment, promotion, publication, transfer, and deployment define separate behavior.

Delivery Phase

Phase 1

Implementation Status

Not Assessed

Implementation status requires verification that Crucible verifies the digital signature associated with an identified Image.

Requirement Status

Draft

The source System Requirements Specification identifies Version 1.1 as a draft.

Notes for Editors

This requirement page should retain the stable requirement identifier FR-IMG-005.

Changes to the Statement SHALL preserve the approved intent of the source requirement.

The Source Statement should preserve the original wording from the controlling System Requirements Specification.

The Statement should remain limited to verification of the digital signature associated with an identified Image.

Requirements for vulnerability scanning, compliance assessment, Image approval, promotion, publication, transfer, and deployment validation should remain in their applicable requirement pages.

Verification criteria should test only the behavior stated in the normalized Statement and should not introduce additional normative obligations.

Incoming Traceability should use the wiki Backlinks function rather than a manually maintained list.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-005#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.