image-rs: dispatch OpenPGP signature verification to blocking thread pool

[Copilot]

Calling CPU-intensive synchronous code directly on an async executor thread risks starving the event loop. The judge_single_signature function — which parses GPG keyrings, decodes and decompresses OpenPGP packet streams, and runs cryptographic verification — was called inline from the async simple_signing_allows_image.

Changes

• image/mod.rs — Derive Clone for Image (all fields already Clone)
• policy/ref_match.rs — Derive Clone for PolicyReqMatchType (string-only enum variants)
• policy/simple/mod.rs — Wrap each judge_single_signature call in tokio::task::spawn_blocking, cloning the necessary data into the closure:

let result = tokio::task::spawn_blocking(move || {
    judge_single_signature(&image, signed_identity.as_ref(), &pubkey_ring, sig)
})
.await
.context("signature verification task panicked")?;

Follows the existing spawn_blocking pattern already used in pull.rs for decryption key derivation.

[Copilot]

Pull request overview

This PR moves CPU-intensive OpenPGP signature verification (judge_single_signature) off Tokio async executor threads by dispatching it to tokio::task::spawn_blocking, preventing potential event-loop starvation during image signature policy checks.

Changes:

• Wrap each judge_single_signature invocation in tokio::task::spawn_blocking within simple_signing_allows_image.
• Derive Clone for Image so it can be moved into blocking tasks.
• Derive Clone for PolicyReqMatchType so policy parameters can be moved into blocking tasks.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
image-rs/src/signature/policy/simple/mod.rs	Offloads OpenPGP signature verification to Tokio’s blocking thread pool.
image-rs/src/signature/policy/ref_match.rs	Adds Clone for PolicyReqMatchType to support moving policy data into blocking tasks.
image-rs/src/signature/image/mod.rs	Adds Clone for Image to support moving image data into blocking tasks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Xynnn007]

@mkulke looks like the dco is wrong. Do you know how to handle this?