{"id":"62fab164-471a-4153-b241-f23dac9d0d3b","task":"Attach a custom in-toto predicate as a cosign attestation and enforce it with a Rego admission policy","domain":"docs.sigstore.dev","steps":["Produce a custom predicate JSON document (e.g. internal compliance-check output) that is not one of cosign's built-in predicate types.","Sign and attach it with cosign attest, setting the predicate file and type to custom, which wraps the predicate in an in-toto statement.","Write a Rego policy that inspects the predicate portion of the attestation for required fields, such as a passing compliance-check status.","Verify the attestation and evaluate the policy together with cosign verify-attestation, passing the Rego policy file and the custom type.","Wire the verify-attestation call into a deployment gate (CI job or admission controller) so images without a passing custom attestation are rejected before promotion."],"gotchas":["Rego policies validate against the predicate portion of the attestation — writing conditions against the outer in-toto envelope fields instead of the predicate fields silently never matches.","The type value used at verification time must match (or be compatible with) what was used at attest time, or verify-attestation reports no matching attestations found."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/62fab164-471a-4153-b241-f23dac9d0d3b"}