Description

Wire the bindings/go/sigstore handler and an OIDC credential plugin into the CLI.

Scope:

• Register ComponentSignatureHandler in the CLI's signing handler registry
• Implement SigstoreOIDC/v1alpha1 credential plugin in cli/internal/plugin/builtin/sigstore/:
  • Checks SIGSTORE_ID_TOKEN env var first (CI/automation path)
  • Falls back to interactive browser-based OIDC flow
  • Default issuer: https://oauth2.sigstore.dev/auth, client ID: sigstore
• Wire plugin into CredentialPluginProvider in cli/cmd/setup/
• Add bindings/go/sigstore to cli/go.mod

Done Criteria

• ocm sign componentversion --signer sigstore works for keyless and key-based credentials
• ocm verify componentversion --verifier sigstore works with and without explicit trusted root
• OIDC credential plugin resolves token from env var and interactive browser flow
• Unit tests cover plugin resolution and handler registration
• Code reviewed by other team members
• Enduser documentation updated (if applicable)
• Successful demonstration in Review