🐛 As Billy points out in the linked issue these are not RFC 3986 complient as required by the in-toto specification. This also creates conflicts with validation in `sigstore/policy-controller` downstream because it has started to allow RFC 3986 compliant `predicateType:` in `ClusterImagePolicy`, but these are not, so they are only accessible via their shortnames (and shortnames have proven fraught becaused they change, like this!). Fixes: https://github.com/sigstore/cosign/issues/2612 /kind bug Signed-off-by: Matt Moore <mattmoor@chainguard.dev>