Add docs about package verification

[dedemorton]

Closes #2005

Please review. Some of the UI-related details are fuzzy because the feature is not yet turned on in the build.

Remaining questions/issues:

• @kpollich Which versions (if any) should I backport this to?
• @elastic/ecosystem Will the docker image for the air gapped registry will have signatures?
• @hop-dev Who is updating the docs at https://www.elastic.co/guide/en/kibana/master/fleet-settings-kb.html to show the package verification setting?
• @dedemorton Need to verify this info by looking at the UI when the feature is turned on. (See if this is necessary.)
• It sounds like we are blocked and shouldn't merge this until https://github.com/elastic/ingest-dev/issues/1193 is resolved.

[apmmachine]

A documentation preview will be available soon:

• 📚 HTML diff
• 📘 Fleet and Elastic Agent Guide
• 📙 Observability Guide

[mergify]

This pull request does not have a backport label. Could you fix it @dedemorton? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-/d./d is the label to automatically backport to the /d./d branch. /d is the digit
  NOTE: backport-skip has been added to this pull request.

[dedemorton]

I've marked this PR as ready for review because I've taken it as far as I can without seeing the UI in a build. @hop-dev Are we still planning to turn this on for 8.5?

[dedemorton]

@hop-dev Has this feature made it into 8.5? I need someone to review the content.

@mtojek Can you please respond to the question about whether the air gapped registry will have signatures?

[mrodm]

@mtojek Can you please respond to the question about whether the air gapped registry will have signatures?

Currently, the docker images that are built for air-gapped envs and used in those Elastic Package registries do not contain the signatures. But we plan to include them soon. This change should be done after switching the DNS to start using package storage v2.

cc @jsoriano

[dedemorton]

Added "blocked" label because I am blocked until https://github.com/elastic/ingest-dev/issues/1193 is merged.

@jen-huang While we're waiting for the DNS switch to v2, can someone please review the content here (and answer my questions) so that this content is ready to go when the feature goes live? Some insight into current plans would also be useful. Thanks!

[jlind23]

@hop-dev @kpollich could you please review this content as asked by @dedemorton ?

[kpollich]

Thanks for this - docs look good. I have filed a separate PR updating the Fleet settings docs, and if the airgapped docs need an update I think it'd be fine to file a followup.

[dedemorton]

@kpollich A couple of quick follow-up questions before I merge this:

• Which versions (if any) should I backport this to?
• Is there an easy way to install an unverified package to confirm the details here? Or maybe that's not necessary since you have reviewed the info?

[kpollich]

Which versions (if any) should I backport this to?

We can backport this to 8.5.

Is there an easy way to install an unverified package to confirm the details here? Or maybe that's not necessary since you have reviewed the info?

I don't think this is necessary. We ran through these scenarios in our testing/development cycle and everything documented here looks accurate. @hop-dev's previous review covered any of the functionality specifics, etc so I think we're good here.