Round 353: Cosign ext, Sigstore ext, Notary ext, OPA ext, Kyverno ext (20 commands)

ober

7d7512201d736af98975df2679c0a3f5fde6f2b6

diff --git a/docs/jemacs-vs-emacs.md b/docs/jemacs-vs-emacs.md
index 6d6520a..83fdad0 100644
--- a/docs/jemacs-vs-emacs.md
+++ b/docs/jemacs-vs-emacs.md
@@ -4583,6 +4583,31 @@ No remaining Tier 1 gaps. All core editing, completion, and navigation features 
 | ebib-import-file | :orange_circle: | Import file into Ebib |
 | ebib-push-citation | :orange_circle: | Push Ebib citation to buffer |
 
+### Round 353 — Cosign ext, Sigstore ext, Notary ext, OPA ext, Kyverno ext
+
+| Feature | Status | Notes |
+|---|---|---|
+| cosign-sign | :orange_circle: | Cosign: sign container image |
+| cosign-verify | :orange_circle: | Cosign: verify image signature |
+| cosign-attach | :orange_circle: | Cosign: attach attestation |
+| cosign-tree | :orange_circle: | Cosign: supply chain tree |
+| sigstore-sign | :orange_circle: | Sigstore: sign artifact |
+| sigstore-verify | :orange_circle: | Sigstore: verify artifact |
+| sigstore-inspect | :orange_circle: | Sigstore: inspect bundle |
+| sigstore-bundle | :orange_circle: | Sigstore: show bundle info |
+| notary-sign | :orange_circle: | Notary: sign artifact |
+| notary-verify | :orange_circle: | Notary: verify artifact |
+| notary-list | :orange_circle: | Notary: list signatures |
+| notary-inspect | :orange_circle: | Notary: inspect artifact |
+| opa-eval | :orange_circle: | OPA: evaluate query |
+| opa-test | :orange_circle: | OPA: run tests |
+| opa-check | :orange_circle: | OPA: check policy |
+| opa-build | :orange_circle: | OPA: build policy bundle |
+| kyverno-apply | :orange_circle: | Kyverno: apply policy |
+| kyverno-test | :orange_circle: | Kyverno: run policy tests |
+| kyverno-validate | :orange_circle: | Kyverno: validate resource |
+| kyverno-policies | :orange_circle: | Kyverno: list policies |
+
 ### Round 352 — Sonarqube ext, Snyk ext, Trivy ext, Grype ext, Syft ext
 
 | Feature | Status | Notes |
diff --git a/src/jerboa-emacs/editor-extra-final.ss b/src/jerboa-emacs/editor-extra-final.ss
index d875ec2..ce8c4a6 100644
--- a/src/jerboa-emacs/editor-extra-final.ss
+++ b/src/jerboa-emacs/editor-extra-final.ss
@@ -25659,3 +25659,55 @@
     (echo-read-string echo "Syft convert format: "
       (lambda (fmt)
         (echo-message! echo (str "Syft: converting SBOM to " fmt))))))
+
+;;; Round 353 — Notary ext, OPA ext, Kyverno ext (batch 2)
+
+(def (cmd-notary-list app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "Notary: listing signatures")))
+
+(def (cmd-notary-inspect app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Notary inspect artifact: "
+      (lambda (art)
+        (echo-message! echo (str "Notary: inspecting " art))))))
+
+(def (cmd-opa-eval app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "OPA eval query: "
+      (lambda (q)
+        (echo-message! echo (str "OPA: evaluating " q))))))
+
+(def (cmd-opa-test app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OPA: running tests")))
+
+(def (cmd-opa-check app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "OPA check policy: "
+      (lambda (pol)
+        (echo-message! echo (str "OPA: checking policy " pol))))))
+
+(def (cmd-opa-build app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OPA: building policy bundle")))
+
+(def (cmd-kyverno-apply app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Kyverno policy file: "
+      (lambda (file)
+        (echo-message! echo (str "Kyverno: applying policy " file))))))
+
+(def (cmd-kyverno-test app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "Kyverno: running policy tests")))
+
+(def (cmd-kyverno-validate app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Kyverno validate resource: "
+      (lambda (res)
+        (echo-message! echo (str "Kyverno: validating " res))))))
+
+(def (cmd-kyverno-policies app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "Kyverno: listing policies")))
diff --git a/src/jerboa-emacs/editor-extra-modes.ss b/src/jerboa-emacs/editor-extra-modes.ss
index 0390530..3743d8a 100644
--- a/src/jerboa-emacs/editor-extra-modes.ss
+++ b/src/jerboa-emacs/editor-extra-modes.ss
@@ -26370,3 +26370,63 @@
     (echo-read-string echo "Trivy scan path: "
       (lambda (path)
         (echo-message! echo (str "Trivy: scanning filesystem " path))))))
+
+;;; Round 353 — Cosign ext, Sigstore ext, Notary ext, OPA ext, Kyverno ext (batch 1)
+
+(def (cmd-cosign-sign app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Cosign sign image: "
+      (lambda (img)
+        (echo-message! echo (str "Cosign: signing " img))))))
+
+(def (cmd-cosign-verify app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Cosign verify image: "
+      (lambda (img)
+        (echo-message! echo (str "Cosign: verifying " img))))))
+
+(def (cmd-cosign-attach app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Cosign attach to image: "
+      (lambda (img)
+        (echo-message! echo (str "Cosign: attaching attestation to " img))))))
+
+(def (cmd-cosign-tree app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Cosign tree image: "
+      (lambda (img)
+        (echo-message! echo (str "Cosign: showing supply chain tree for " img))))))
+
+(def (cmd-sigstore-sign app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Sigstore sign artifact: "
+      (lambda (art)
+        (echo-message! echo (str "Sigstore: signing " art))))))
+
+(def (cmd-sigstore-verify app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Sigstore verify artifact: "
+      (lambda (art)
+        (echo-message! echo (str "Sigstore: verifying " art))))))
+
+(def (cmd-sigstore-inspect app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Sigstore inspect bundle: "
+      (lambda (bundle)
+        (echo-message! echo (str "Sigstore: inspecting " bundle))))))
+
+(def (cmd-sigstore-bundle app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "Sigstore: showing bundle info")))
+
+(def (cmd-notary-sign app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Notary sign artifact: "
+      (lambda (art)
+        (echo-message! echo (str "Notary: signing " art))))))
+
+(def (cmd-notary-verify app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Notary verify artifact: "
+      (lambda (art)
+        (echo-message! echo (str "Notary: verifying " art))))))
diff --git a/src/jerboa-emacs/editor-extra-regs2.ss b/src/jerboa-emacs/editor-extra-regs2.ss
index 692c256..ab1eee3 100644
--- a/src/jerboa-emacs/editor-extra-regs2.ss
+++ b/src/jerboa-emacs/editor-extra-regs2.ss
@@ -8848,4 +8848,26 @@
   (register-command! 'syft-packages cmd-syft-packages)
   (register-command! 'syft-cataloger cmd-syft-cataloger)
   (register-command! 'syft-convert cmd-syft-convert)
+
+  ;; Round 353 — Cosign ext, Sigstore ext, Notary ext, OPA ext, Kyverno ext
+  (register-command! 'cosign-sign cmd-cosign-sign)
+  (register-command! 'cosign-verify cmd-cosign-verify)
+  (register-command! 'cosign-attach cmd-cosign-attach)
+  (register-command! 'cosign-tree cmd-cosign-tree)
+  (register-command! 'sigstore-sign cmd-sigstore-sign)
+  (register-command! 'sigstore-verify cmd-sigstore-verify)
+  (register-command! 'sigstore-inspect cmd-sigstore-inspect)
+  (register-command! 'sigstore-bundle cmd-sigstore-bundle)
+  (register-command! 'notary-sign cmd-notary-sign)
+  (register-command! 'notary-verify cmd-notary-verify)
+  (register-command! 'notary-list cmd-notary-list)
+  (register-command! 'notary-inspect cmd-notary-inspect)
+  (register-command! 'opa-eval cmd-opa-eval)
+  (register-command! 'opa-test cmd-opa-test)
+  (register-command! 'opa-check cmd-opa-check)
+  (register-command! 'opa-build cmd-opa-build)
+  (register-command! 'kyverno-apply cmd-kyverno-apply)
+  (register-command! 'kyverno-test cmd-kyverno-test)
+  (register-command! 'kyverno-validate cmd-kyverno-validate)
+  (register-command! 'kyverno-policies cmd-kyverno-policies)
 )