sign nerdctl binaries and container images with cosign

[developer-guy]

Let's sign nerdctl binaries with cosign, and make them verifiable for the end-users by providing clear text on the releases page about how they can do it. AFAIK, nerdctl uses GitHub Actions and GoReleaser to make a new release, so, it is easy to integrate the signing process into the workflow because there is already GitHub action for installing cosign.

But, the question is should we consider using keyless mode or using public/private key pairs while signing binaries/images?

• https://chainguard.dev/posts/2021-12-01-zero-friction-keyless-signing
• https://github.com/sigstore/cosign-installer
• https://github.com/caarlos0-graveyard/gorel-keyless

Similar efforts:

• use keyless approach while signing and verifying GoReleaser checksums.txt file goreleaser/goreleaser#2713
• Sign released ko binaries ko-build/ko#491

cc: @Dentrax @AkihiroSuda

[AkihiroSuda]

I've been already signing (the SHA256SUMS of) the binaries with my GPG key

https://github.com/containerd/nerdctl/releases/download/v0.14.0/SHA256SUMS.asc
https://github.com/AkihiroSuda.gpg

[developer-guy]

yep, I know, but IMHO, signing them with cosign, especially keyless, is a more proper way of doing this. With this approach, we don't need keys to manage or remember their passwords or don't need to be afraid of having them stolen. WDYT?

[AkihiroSuda]

With this approach, we don't need keys to manage or remember their passwords or don't need to be afraid of having them stolen.

I still need to manage my key, remember its password, and be afraid of having them stolen because I use the same key for signing git commits and other stuffs.

[AkihiroSuda]

I intend to continue using GPG, so let me close this, but we can revisit this again later.