Am/example/tvc cosign

tvc-cosign/.dockerignore

@@ -0,0 +1,11 @@
+# Keep the build context minimal and deterministic: only Cargo manifests, src,
+# and the baked ruleset are COPYed in the Dockerfile. Excluding everything else
+# ensures the image digest is a pure function of the committed source.
+/target
+/notes
+/.git
+/.claude
+*.local.toml
+.env
+README.md
+rules.example.toml

tvc-cosign/.gitignore

@@ -0,0 +1,17 @@
+# Rust build artifacts
+/target
+
+# Per-deployment ruleset: compiled into the binary via include_str!, but it holds
+# each deployer's own allowlists. Create it from rules.example.toml before building
+# (see README Step 1); this demo does not commit its rules, but you might want to do so if it fits your use case.
+/rules.toml
+
+# Local secrets / ruleset overrides (never commit real ones)
+*.local.toml
+.env
+
+# Extracted pivot binaries / digest-check artifacts
+*.bin
+
+# Notes
+/notes