Possible Solution:

• Solution 1: copy the manifest list as it is with its signature (cosign tag-based).

               Requirement 1: To test this solution it is necessary a registry which supports sparse manifest (does not verify if all the images on the manifest list are present). Also with this solution the customer should use a supported registry.
               Requirement 2: OCPSTRAT-1869 / CLID-289 needs to be done

Open Questions:

• Level of the signature

           Question 1: Is the signature in the higher level (manifest list) or is it on the manifest level (image level) ? 

Dependencies

• CRI-O: should work already (need QE to verify): OCPNODE-2713
• `containers/image` library: ~Jan/Feb 2025: RUN-2377
• Quay: ~Jun 2025: PROJQUAY-3114