integrate Rego or CUE for validation provenance metadata

[developer-guy]

At the time of writing this, there are some options for validating the final provenance like tag, branch, etc.¹ We (w/@Dentrax) thought that maybe people could write Rego policies against them to do the same validation. Instead of adding every flag to the command, people can write a Rego policy to define what they want to validate, similar to what we did in cosign project.²

Footnotes

1. https://github.com/slsa-framework/slsa-verifier/blob/main/options/options.go#L4 ↩

2. https://github.com/sigstore/cosign/pull/641 ↩

[ianlewis]

If the verifier was able to accept the same CUE or rego policies that cosign can verify that would be ideal. I don't know how specific they need to be to cosign though.