Furkan Türkal

**Description of issue or feature request**: We propose adding [Predicate: SPDK](https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md) model in order to validate the spec contract by asserting each field of the content. Similar to https://github.com/in-toto/in-toto/issues/464 We...

**Description of issue or feature request**: I propose adding [Predicate: Provenance](https://github.com/in-toto/attestation/blob/main/spec/predicates/provenance.md) type in order to validate content contract. To get used to in-toto's project domain, I think that it's a...

**Description** For example, my image has the following signature: ``` MEUCIFV6mSGmtEEgmXa5QJHZs/NEdemSKMqcFibwdjASkpsHAiEAq5Wb5ikOLYMC7Mu0bOE8VhBujtGsyKv6eHFLgeO3WsE= ``` What I want to do is that search the entire index and find the matching entries by issuing:...

Ability to sign tlog with GPG

15

**TL;DR:** We propose signing the tlog entities using GPG to verify source of truth --- **Description** If we sign a file using [keyless](https://github.com/sigstore/cosign/blob/main/KEYLESS.md) mode with cosign, we [upload](https://github.com/sigstore/cosign/blob/2ad95b34299b6e4f5fa32f1e161ce0b670b7c47a/cmd/cosign/cli/sign/sign_blob.go#L94) a tlog...

**Description** Currently, the following error means that `checksums.txt` does not found in the current directory, which is a bit confused message to see what's going on actually: ```bash $ rekor-cli...

consider moving core sign & verify functions from cosign to sigstore

13

**TL;DR:** _I propose transferring the core crypto functions of cosign to project Sigstore._ **Motivation** We aim to make sigstore more _commonize_ for cryptographic functions. Cosign calls the all the crypto-specific...

GitOps Storage: add support for specifying a Git provider for storage backend

3

**TL;DR:** We are proposing to add a new storage backend for GitHub/GitLab to store/mirror the charts. --- GitOps is having a Git repository that always contains declarative descriptions of the...

How to ensure `cache` is not tampered in build system

3

We can pass some `cache` flags to buildx but just thinking if someone who have access to registry/build system have the ability to alter the data/cache? Is it tamper resistant...

**What steps did you take:** ``` $ sudo -E kwt net start ``` **What happened:** ``` Error: Building Kubernetes config: stat :/Users/furkan.turkal/.kube/config:/Users/furkan.turkal/.kube/config-aws:/Users/furkan.turkal/.kube/config-gcloud:/Users/furkan.turkal/.kube/config-local: no such file or directory ``` **What did...

I'm not so sure how we can make the following logs much beautify, but here is what I'm proposing: **On New Announcement** Current: ``` New announcement detected: API3 ``` New:...