feat: Signing & Trust v1 (milestone 2)#203

Open

michael-herwig wants to merge 9 commits into

mainfrom

feat/signing-and-trust

Commits on Jul 9, 2026

feat(cli,oci): ocx package sign + verify via keyless Sigstore (slice 1)
michael-herwig
committed
chore(claude): OCI referrers sign/verify planning + AI config
michael-herwig
committed
test: referrers-capable acceptance registry (zot) + smoke test
michael-herwig
committed
feat(oci,cli): implement keyless Sigstore sign/verify pipeline (#194)
michael-herwig
committed
feat(oci): identity-pinned verify via [trust.policy] (#98)
michael-herwig
committed
feat(oci,cli): offline/air-gapped verify + trust-root cache (#196)
michael-herwig
committed
feat(oci,cli): policy-gated auto-verify on install/pull (#99)
michael-herwig
committed
docs(signing): document honest deferral of Rekor v2 (#107) and cosign v3 interop (#197)
michael-herwig
committed
fix(oci,cli): integrate signing & trust onto current main
michael-herwig
committed