Ville Aikas

@vaikas @cpanato maybe we should beef up the `setup-kind` testing here to setup `sigstore/scaffolding`? Then we should be able to detect this pretty quickly 🤞

1

@vaikas @cpanato maybe we should beef up the `setup-kind` testing here to setup `sigstore/scaffolding`? Then we should be able to detect this pretty quickly 🤞 _Originally posted by @mattmoor in...

A pipeline that had a stray space in it caused the entire pipeline to not work, because it was not parsed correctly. For an example, you can see here https://github.com/chainguard-dev/melange/pull/1044...

Sometimes the package that you want to convert may be not in the base location, and you can override this with --base-uri-format, but then if there are dependent packages that...

As I discovered during testing of: https://github.com/wolfi-dev/os/pull/5147 The update block should only be owner/repo, but it currently prints the whole URL.

There's been some changes (to my untrained eye at least) for the go/build. https://github.com/chainguard-dev/melange/blob/main/docs/PIPELINES-GO.md This tracks making sure we vet the existing documentation and updates with any new features. For...

update npm versions

2

Update packages that are out of date.

Add ability to install specific versions of Fulcio, Rekor, etc.

1

**Description** It would be nice to be able to specify which release version of the components should be stood up, for example: https://github.com/sigstore/cosign/pull/2402#issuecomment-1301150996 It would be nice to be able...

Question: What would we expect whenever the server restarts ? It is okay to recreate the repository again and again.

4

Question: What would we expect whenever the server restarts ? It is okay to recreate the repository again and again. _Originally posted by @hectorj2f in https://github.com/sigstore/scaffolding/pull/262#discussion_r936780240_

**Description** Terraform on GCP was added here: #93 We should document it.

Cue policy in test file for two attestations does not work.

3

**Description** The following is a CIP policy json that's being evaluated: ``` { "authorityMatches": { "keyatt": { "signatures": null, "attestations": { "custom-match-predicate": [ { "subject": "", "issuer": "" } ]...