John Kjell

Looks like we're missing a couple of test files: `./test/policy-signed.json` and `./test/policy.json`.

Investigate possible differences in TSA implementations. This isn't an issues with freetsa

> Maybe command-run simply should be listed here This is maybe a useless philosophical perspective for end users but, for me, `command-run` is implicit in the invocation of `witness run`....

This may exist today but, we need to check.

Envelope size data should be available

We should evaluate other options as well. Prometheus is the most probable choice.

Hey Naveen, finally got all the pipeline stuff worked out. Can you rebase this? Thanks!

Make sure the solution here will work with pluggable DB backend

@matglas I brought everything up-to-date and resolved the conflicts. I added one more comment about backwards compatibility. I think if we can get that and testing to ensure it works,...

Yes, I think this is a good path forward. So, we would need to add the `includeGlob` and `exclude` glob from the product [Attestor struct](https://github.com/in-toto/go-witness/blob/main/attestation/product/product.go#L97), to the [MarshalJSON](https://github.com/in-toto/go-witness/blob/main/attestation/product/product.go#L176) and [UnmarshalJSON](https://github.com/in-toto/go-witness/blob/main/attestation/product/product.go#L180)...