Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update the roadmap after v1.3.0 release #1817

Merged
merged 15 commits into from
Sep 25, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 22 additions & 15 deletions ROADMAP.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

## Overview

At Ratify, our mission is to safeguard the container supply chain by ratifying trustworthy and compliant artifacts. We achieve this through a robust and pluggable verification engine that includes built-in verifiers. These verifiers can be customized to validate supply chain metadata associated with artifacts, covering essential aspects such as signatures and attestations (including vulnerability reports, SBOM, provenance data, and VEX documents). As the landscape of supply chain security evolves, we actively develop new verifiers, which can be seamlessly integrated into our verification engine. Additionally, if you have a specific use case, you can create your own verifier following our comprehensive guidance. Each verifier will generate detailed verfication reports, which can be consumed by various policy controllers to enforce policies.
At Ratify, our mission is to safeguard the container supply chain by ratifying trustworthy and compliant artifacts. We achieve this through a robust and pluggable verification engine that includes built-in verifiers. These verifiers can be customized to validate supply chain metadata associated with artifacts, covering essential aspects such as signatures and attestations (including vulnerability reports, SBOM, provenance data, and VEX documents). As the landscape of supply chain security evolves, we actively develop new verifiers, which can be seamlessly integrated into our verification engine. Additionally, if you have a specific use case, you can create your own verifier following our comprehensive guidance. Each verifier will generate detailed verification reports, which can be consumed by various policy controllers to enforce policies.

Ratify is designed to address several critical scenarios. It seamlessly integrates with OPA Gatekeeper, acting as the Kubernetes policy controller that shields your cluster from untrustworthy and non-compliant container images. As an external data provider for Gatekeeper, Ratify delivers artifact verification results that are in alignment with defined policies. Additionally, Ratify enhances security at the Kubernetes node level by extending its capabilities to container runtime through its plugin interface, which allows for detailed policy evaluations based on artifact verification outcomes. Lastly, incorporating Ratify into your CI/CD pipeline ensures the trustworthiness and compliance of container images prior to their usage.

Expand Down Expand Up @@ -60,39 +60,46 @@ See details in [GitHub milestone v1.2.0](https://github.com/ratify-project/ratif

### v1.3

**Status**: In progress
**Status**: Completed

**Target date**: Sep 16, 2024

**Target date**: Aug 30, 2024
**Release link**: [v1.3.0 Release Notes](https://github.com/ratify-project/ratify/releases/tag/v1.3.0)

**Major features**

- Error logs improvements
- Kubernetes multi-tenancy support (Verifying Common images across namespaces)
- Cosign keyless verification using OIDC settings
- Notary Project signature verification with Time-stamping support
- Signing Certificate/key rotation support
- Support of validating Notary Project signatures with timestamping
- Support of periodic retrieval of keys and certificates stored in a Key Management System
- Introducing trust policy configuration for Cosign keyless verification
- Error logs improvements for artifact verification

See details in [GitHub milestone v1.3.0](https://github.com/ratify-project/ratify/issues?q=is%3Aopen+is%3Aissue+milestone%3Av1.3.0).

### v1.4

**Status**: Tentative
**Status**: In process

**Target date**: Nov 30, 2024

**Major features**

- Attestations support
- Ratify supports Azure Trusted Signing as a new KeyManagementProvider
- Use Ratify at container runtime (Preview)
- Enable revocation checking using CRL (Certificate Revocation List) for Notary Project signatures
- Add Trusted Signing as a Key Management Provider
- Support retaining multiple previous versions of certificates/keys in Key Management Provider
- Artifact filtering based on annotations

### v2.0
See details in [GitHub milestone v1.4.0](https://github.com/ratify-project/ratify/issues?q=is%3Aopen+is%3Aissue+milestone%3Av1.4.0).

### v2.x

Status: Tentative

Target date: TBD

**Major features**

- Use Ratify in CI/CD pipelines (Preview)
- Support CEL as additional policy language
- Attestations support
- Kubernetes multi-tenancy support - Verifying Common images across namespaces
- Use Ratify at container runtime
- Use Ratify in CI/CD pipelines
- Support CEL as additional policy language
Loading