📄️ Executor
The executor is the 'glue' that links all Ratify plugin-based components such as the verifiers, referrer stores, and policy providers. The executor handles all components of the verification process once a subject verification request is received either via CLI or server.
📄️ Framework Overview
Ratify is a verification engine that coordinates the verification of supply chain artifacts (signatures, SBOMs, attestations, and other metadata) associated with an image, and produces a single trust decision that an admission controller such as OPA Gatekeeper can act on.
📄️ Store
A referrer store (or store) discovers and retrieves artifacts and their referrers (signatures, SBOMs, and other metadata) for a subject image. Stores are one of the pluggable components that the Executor coordinates during verification.
📄️ Verifier
A verifier validates a specific artifact type (for example a signature) associated with a subject image and returns a verification report. Verifiers are one of the pluggable components that the Executor coordinates during verification.
