Tim Seagren

Yeah, one year on and the `notary verify` subcommand does nothing.

@developer-guy rebased!

Looks like I forgot to sign off on the last commit, I can go ahead and sign off and repush if that's preferable.

@hectorj2f somewhere in [here](https://github.com/sigstore/cosign/blob/c1322bc24fc199687090543633cc2b0feb1f221b/test/e2e_test.go#L233) make sense?

> Yep, the e2e tests would be a good place, or adding unit tests. I'd be happy to add some unit tests to some commands going forward, when I have...

It looks like the docsign failed because of some whitespace I removed after `--replace` in the cli docs, and then the "Test attest" check failed for dubious reasons.

Hi @hectorj2f I should have been more clear about the `syft` command I was referencing. `syft` as of version `0.30.1` will output a CycloneDX SBOM in XML format when running...

This isn't a critical add, just a feature of convenience in case only XML CycloneDX SBOMs are available to those looking to add them as attestations.

@bryantbiggs can you clarify what your suspicions are? I'm running into this same issue with `18.26.6`, although the issue is persisting despite setting `cluster_endpoint_public_access` to `true` as a last resort.

Our module terraform looks like this (vars substituted with representative values): ``` module "eks" { source = "terraform-aws-modules/eks/aws" version = "18.26.6" # Metadata cluster_name = "test-cluster" cluster_version = "1.21" #...