apiVersion: catalyst.openova.io/v1
kind: Blueprint
metadata:
  name: sigstore
  labels:
    catalyst.openova.io/section: pts-3-3-security-and-policy
spec:
  version: 1.0.0
  card:
    title: Sigstore Policy Controller
    family: guardian
    description: Admission controller for signed-image enforcement (Sigstore/Cosign). Verifies signatures + attestations on container images before admission. Pairs with bp-harbor/bp-cosign for the supply-chain trust path.
    docs: https://docs.sigstore.dev/policy-controller/overview/
