[docs] Verification with sigstore-policy-controller

[ianlewis]

Document examples using sigstore-policy-controller to verify provenance.

[laurentsimon]

There's also https://github.com/sigstore/cosign-gatekeeper-provider for gatekeeper, but it seems the gatekeeper's feature is in alpha mode.

/cc @developer-guy (maintainer for the repo above)

[ianlewis]

There's also https://github.com/sigstore/cosign-gatekeeper-provider for gatekeeper, but it seems the gatekeeper's feature is in alpha mode.

/cc @developer-guy (maintainer for the repo above)

I wonder if this supports writing policy against the provenance. At first glance it looks like it just verifies signatures?

[laurentsimon]

It's up to us to implement it, so we could make the plugin call our SLSA verifier once we have an API available for it.
/cc @asraa

[laurentsimon]

@developer-guy would you happen to know someone who is versed in https://docs.sigstore.dev/policy-controller/overview and could give us a hand with a policy example?

Basically, we want to show how to verify our SLSA provenance with a policy.