OCI rule pack distribution

[mostafa]

Summary

Ship rsigma pack push/pull/verify for versioned, signed, content-addressed rule packs through OCI registries, reusing the project's keyless cosign and SLSA provenance patterns.

Motivation

Detection-as-code teams already run registries for charts and policies. Packs give Sigma corpora the same signed supply-chain channel without inventing a bespoke distribution protocol.

Proposed approach

• Extend the precompiled pack media type with push (manifest annotations), policy-enforced pull (digest pinning, verify-required gate), and keyless verify.
• Use oci-client + sigstore; support offline bundle flow for air-gapped estates.
• Keep the daemon registry-free: cron/systemd or an operator pulls; the daemon hot-reloads from disk.

Out of scope

• Daemon-native registry polling.
• Unsigned git sync (separate item).
• Authoring a marketplace UI.

Tasks

• Pack push with annotations
• Pull with digest pin and verify gate
• Native keyless verify + offline bundle
• CLI docs and supply-chain notes

References

• Existing cosign/SLSA release workflows
• Pack serialization format from IR pack work
• Daemon file-watch hot-reload