Definition of a container image label

[wurstbrot]

💡 Summary

Add a definition of a container image label

Motivation and context

In a quality gate, I want to check if an image is passing predefined checks before it is going to be deployed.
One rudimentary check could be, if CSAF is available for that image/organisation. CSAF so far is using for example /.well-known/security.txt to point out where to find provider-metadata.json.

Implementation notes

Defining a container image label, e.g. org.oasis-open.csaf.provider-metadata with a URL pointing to a provider-metadata.json would be great. This does not check the quality, but would be a first step.

Acceptance criteria

How do we know when this work is done?

• Image label is defined

[tschmidtb51]

I guess that is something for the CSAF TC to decide. Please formally comment on their comment mailing list: https://groups.oasis-open.org/communities/community-home?CommunityKey=3720cda2-3056-4183-a759-018f5aa7b5f2