Criteria for client library maturity

[znewman01]

There's many Sigstore client libraries, with varying levels of support for signing, verification, conformance testing, etc.

We should articulate criteria for client library maturity, especially a gate for a 1.0 release.

See also sigstore/sigstore-rs#274

[woodruffw]

Agreed! Just to spitball a bit:

• Signing: not all clients have to support signing, but for those that do:
  • Support for signing arbitrary inputs/files, not just containers (what cosign calls "blob" mode)
  • Support for the OIDC/ephemeral signing key flow
  • Support for emitting Sigstore bundles
• Verification: not all clients have to support verification, but for those that do:
  • Support for verifying arbitrary inputs/files, not just containers
  • Support for consuming Sigstore bundles + support for all "facets" of the bundle (sig itself, inclusion proof, etc.)
  • Both online and offline verification?
• Testing: The client should pass the conformance suite, or some designated subset of it