FR-IMG-006 — Image Promotion Workflows

Go to Crucible Image Management Requirements

Crucible SHALL promote an identified Image from one defined promotion state to another after the Image satisfies the applicable transition criteria.

The system shall support image promotion workflows.

Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-IMG-006.

The source statement expresses the approved intent but does not provide a fully testable formulation.

The following Specification Discipline and Authoring findings apply:

• The system does not use the defined system name
• shall does not follow the established uppercase normative convention
• Support is a weak verb that does not identify the required behavior
• Image promotion workflows does not identify the Image being promoted
• The source statement does not identify the states between which promotion occurs
• The source statement does not identify the conditions governing a promotion transition
• The source statement does not identify an observable promotion result
• The source statement does not prescribe a particular state model, repository, release process, or implementation technology

The normalized Statement:

• Replaces The system with Crucible
• Replaces support with the direct behavior promote
• Identifies an Image as the subject of promotion
• Identifies movement between defined promotion states
• Requires satisfaction of applicable transition criteria before promotion
• Retains one primary required behavior
• Preserves implementation independence

The normalized Statement does not prescribe the names or number of promotion states. The applicable promotion workflow defines those states and their transition criteria.

Image promotion controls the progression of an identified Image through defined states associated with evaluation, approval, release, distribution, or deployment.

Example promotion states may include:

• Built
• Evaluated
• Signed
• Verified
• Approved
• Staged
• Released
• Available for deployment
• Retired

The applicable workflow determines which states apply and which transitions are permitted.

Transition criteria may include:

• Successful build completion
• Successful digital-signature verification
• Successful vulnerability assessment
• Successful compliance assessment
• Required test results
• Required approval
• Required Evidence
• Compatibility with a target environment
• Satisfaction of applicable release conditions

FR-IMG-006 does not independently require any particular signing, testing, scanning, compliance, or approval criterion. The applicable lower-level requirement or promotion policy establishes each criterion.

Controlled Image promotion contributes to:

• Prevention of unauthorized Image use
• Consistent release decisions
• Controlled Image distribution
• Controlled Image deployment
• Image-state visibility
• Provenance
• Auditability
• Traceability

This requirement applies to:

• Crucible
• Images
• Machine Images
• Container Images
• Image identifiers
• Image promotion states
• Promotion-state transitions
• Transition criteria
• Image promotion workflows
• Image repositories
• Image release workflows
• Image deployment workflows
• CI/CD Pipelines

1. Verification SHALL confirm that the applicable Image promotion workflow defines at least two promotion states
2. Verification SHALL confirm that the applicable Image promotion workflow defines the permitted transition between the tested promotion states
3. Verification SHALL confirm that the tested transition identifies applicable transition criteria
4. Verification SHALL confirm that Crucible promotes the identified Image when the Image satisfies the applicable transition criteria
5. Verification SHALL confirm that Crucible does not perform the tested promotion transition when the Image does not satisfy the applicable transition criteria
6. Verification SHALL confirm that Crucible records the resulting promotion state

Verification may include:

• Machine Image promotion testing
• Container Image promotion testing
• Successful-transition testing
• Failed-transition testing
• Transition-criteria inspection
• Image-state inspection
• Promotion-record inspection
• Image-repository inspection
• Promotion-log inspection
• Automated CI/CD Pipeline testing

The verification record SHALL identify:

1. The promoted Image
2. The Image identifier
3. The initial promotion state
4. The requested promotion state
5. The applicable transition criteria
6. The observed criteria results
7. The promotion decision
8. The resulting promotion state
9. The promotion result
10. The generated Evidence

This requirement realizes:

• MO-001
• MO-005
• MO-006

This requirement relates to:

• FR-IMG-001 — Build Virtual Machine Images
• FR-IMG-002 — Build Container Images
• FR-IMG-003 — Immutable Infrastructure Workflows
• FR-IMG-004 — Image Signing
• FR-IMG-005 — Image Verification
• C.3.3 Deployment Orchestration
• C.3.6 Compliance Management
• 6. Machine Images and Image Layers
• 9. Compliance and Security
• 10. Reproducibility, Provenance, and Traceability

The wiki Backlinks function provides the current list of pages that reference FR-IMG-006.

Incoming Traceability should be derived dynamically from backlinks rather than maintained as a duplicate manual list.

Backlinks identify incoming references but do not define the semantics of each relationship. Referencing pages should identify whether the relationship represents realization, refinement, verification, dependency, or another defined traceability relationship.

The Crucible Concept of Operations describes a Phase 1 workflow that builds, evaluates, and deploys controlled Image Artifacts through an automated CI/CD Pipeline.

FR-IMG-006 establishes the required behavior for progressing an identified Image between defined promotion states after satisfaction of the applicable transition criteria.

Requirements governing Image building, signing, verification, compliance assessment, publication, transfer, and deployment define the behavior or conditions associated with particular promotion transitions.

Phase 1

Not Assessed

Implementation status requires verification that Crucible promotes an identified Image from one defined promotion state to another after the Image satisfies the applicable transition criteria.

Draft

The source System Requirements Specification identifies Version 1.1 as a draft.

This requirement page should retain the stable requirement identifier FR-IMG-006.

Changes to the Statement SHALL preserve the approved intent of the source requirement.

The Source Statement should preserve the original wording from the controlling System Requirements Specification.

The Statement should remain limited to promotion of an identified Image between defined promotion states after satisfaction of applicable transition criteria.

The applicable workflow or lower-level requirements should define the promotion states and transition criteria without adding those details to this requirement unless the controlling source changes.

Verification criteria should test only the behavior stated in the normalized Statement and should not introduce additional normative obligations.

Incoming Traceability should use the wiki Backlinks function rather than a manually maintained list.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:fr-img-006#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.