Signed-off-by: Bob Callaway <bob.callaway@gmail.com>

Signed-off-by: Dan Lorenc <lorenc.d@gmail.com>

Matches the other sigstore project README's

Signed-off-by: Nathan Smith <nathan@nfsmith.ca>

installation.md doesn't exist anymore

Signed-off-by: Sylvestre Ledru <sylvestre@debian.org>

* Delete INSTALLATION.md

Signed-off-by: Edoardo Tenani <edoardo.tenani@pm.me>

* Delete release-verify.md

Signed-off-by: Edoardo Tenani <edoardo.tenani@pm.me>

* Update README.md

Signed-off-by: Edoardo Tenani <edoardo.tenani@pm.me>

* Update README.md

Signed-off-by: Edoardo Tenani <edoardo.tenani@pm.me>

* Apply suggestions from code review

Co-authored-by: Bob Callaway <bobcallaway@users.noreply.github.com>
Signed-off-by: Edoardo Tenani <edoardo.tenani@pm.me>

Co-authored-by: Bob Callaway <bobcallaway@users.noreply.github.com>

Signed-off-by: Luke Hinds <lhinds@redhat.com>

Signed-off-by: Luke Hinds <lhinds@redhat.com>

Provide instructions on verifying signatures

Note this is quite lengthy / hand wavy, but I believe
its better we show how our trust model works.

I also point out how much of this will be streamlined and improved
via the TUF integration

Signed-off-by: Luke Hinds <lhinds@redhat.com>

Signed-off-by: Dan Lorenc <lorenc.d@gmail.com>

As we have moved away from the rekor.dev domain, switching over to
rekor.sigstore.dev for the public instance. api.sigstore.dev still works
as an alias.

Fixes #305

Signed-off-by: Bob Callaway <bob.callaway@gmail.com>

I will perform a 'lazy consensus' and self-merge this is not
approved by 07/05/2021

The idea is to point to one file in community where we can
add to the security handling process without updating all repos.

Signed-off-by: Luke Hinds <lhinds@redhat.com>

them to GCS.

We don't always have a new one, and under load there might be "batches" of entries
all integrated into the same STH. This means there is no guaranteed frequency of updates
or even a guarantee that every index will exist.

The values (and timestamps) should be monotonically increasing though.

Signed-off-by: Dan Lorenc <dlorenc@google.com>

Signed-off-by: Dan Lorenc <dlorenc@google.com>

Signed-off-by: Luke Hinds <lhinds@redhat.com>

Domain name update

Signed-off-by: Luke Hinds <lhinds@redhat.com>
Co-authored-by: Stephen Augustus <justaugustus@users.noreply.github.com>

All instances of projectrekor are now renamed to SigStore

This includes:

* Import paths
* Tests
* Readme's

Signed-off-by: Luke Hinds <lhinds@redhat.com>

fixes #149

Signed-off-by: Luke Hinds <lhinds@redhat.com>

* README updates

Details on how to build the server and verify amendments

Implement upload command

Accept flags artifact-url,public-key, signature and validate GPG formatting and verify file signature

* Remove unsed files (log_server, inclusion (which is now get)

* Add some meaningful text to CLI help

* Make the README more specific to the new role of the CLI (direct
connections to rekor server)

map server not needed