kitops-ml
Sign the Vibes
Describe the problem you're trying to solve Many users already rely on Cosign for signing and attesting OCI artifacts. Today you can use it to sign KitOps ModelKits - but it's a two step / two tool process.
Describe the solution you'd like
To provide a seamless end-to-end experience within KitOps, we should add analogous kit sign and kit attest subcommands to the kit CLI. This will allow users to sign ModelKits and attach attestations without switching tools.
New subcommands:
- kit sign
- kit attest
- kit verify
Follow the same flag semantics as cosign for sing and attest but verify should cover both ModelKit signing and attestation verification.
I would like to work on this issue. I went through the signing flow with cosign and verifying the signature. Also should the signature be published to the public transparency log by default (via Rekor), or should users be allowed to choose whether to publish or not?
