Stale kusari-oss references: signing identities, container image name, package metadata #583

Summary

171 references to kusari-oss remain in 35 files under docs/, packaging/, README.md, the pyproject.toml files and the workflows. Most are links that GitHub redirects. Some ae not harmless, and with 0.2.0 coming it seemed worth sorting them.

packaging/README.md already states the rule: "Sigstore certificate identities do not redirect", releases cut after the move resolve against darnitdevorg/darnit, and two things stay under the old org on purpose (the Homebrew tap and the kusari-oss entry in DEFAULT_TRUSTED_PUBLISHERS).

1. Signing identities in user-facing verification commands

These tell users to verify against the old identity:

• docs/install/README.md:47, :53
• docs/install/binary.md:43
• docs/install/container.md:49, :74
• docs/install/pypi.md:76 (fixed by docs: stop recommending pip --verify-attestations #530, still open)
• packaging/RECOVERY.md:149, :155, :242
• packaging/container/README.md:65

A user who follows them for a release signed under darnitdevorg/darnit gets a verification failure on a genuine artifact.

Question: the examples all use v0.1.0. If 0.1.0 was published before the move, the old identity is correct for that version. Should the docs move to the new identity with a newer example version, or state which identity applies to which versions?

2. Container image name

release.yml pushes to ghcr.io/${{ github.repository_owner }}/darnit, which is now ghcr.io/darnitdevorg/darnit. docs/install/container.md, packaging/container/README.md and packaging/RECOVERY.md use ghcr.io/kusari-oss/darnit throughout (pull, run, cosign verify, cosign download attestation).

I do not think GHCR redirects image names between organizations, so these would not find new releases. I have not tested it.

3. Package metadata

pyproject.toml (root and packages/*) set Homepage, Repository and Issues to https://github.com/kusari-oss/darnit. They redirect, but they are what PyPI will show for 0.2.0.

4. docs/install/from-source.md

• Line 11 clones https://github.com/kusari-oss/darnit (redirects).
• Lines 25 and 35 say the baseline has 62 controls. darnit list reports 66.

5. Plain links

Release download URLs, issue links and the like, across the install docs, README.md, docs/SECURITY_GUIDE.md and docs/getting-started/. They redirect. Low priority.

Deliberate, not to change

• kusari-oss/homebrew-tap and brew tap kusari-oss/tap, including the three references in release-smoke.yml.
• The kusari-oss entry in DEFAULT_TRUSTED_PUBLISHERS.

Suggested order

1, 2 and 3 before 0.2.0 is published. 4 and 5 whenever.

I can send PRs for any of these once the question in section 1 is answered. Context: this is the follow-up I mentioned in #530.

Counted on main at 24a4fed with git grep -c kusari-oss -- docs/ packaging/ README.md pyproject.toml 'packages/*/pyproject.toml' '.github/workflows/*.yml'.

Drafted with Claude; reviewed and filed by me.