dlorenc

> It looks like it doesn't support configuring `aud` (e.g. to `sigstore`) Yep, I think it's up to us to decide if that's too problematic to add support. We can...

Amazing news!

I'd honestly still rather wait here until we have a plan. I don't think it's going to take forever to get something drafted, but doing it in a rush before...

Ok so for a plan, we can leave this around until the new repo is created and we've done a release from there. That way we can delete here without...

IMO the probers we have are sufficient for GA, although they can always be improved.

Not a GA blocker IMO.

Hey, Any interest in this? We're looking into firming up the payload/attestation format soon in sigstore and would like to use the descriptor. We'd really like to use the same...

Actually looking at the usage in the current example, the references field is only used for x509 cert validation. I think that can actually just be dropped rather than reused....

Ah I get it. So instead of list[string-string] you mean object{}, or at least list[list[string]-string]. That would be nice.

@jonjohnsonjr WDYT?