cosign: Add a public key for testing

[justaugustus]

What type of PR is this?

/kind feature

What this PR does / why we need it:

(Part of #2227)

cosign: Add a public key for testing

Preliminary steps to sign/verify artifacts via cosign.
The process or needs will evolve over time, so we've opted to generate
a "test" key to start.

Signed-off-by: Stephen Augustus [email protected]

ref: kubernetes/k8s.io#2614
cc: @kubernetes/sig-release-admins

Which issue(s) this PR fixes:

Special notes for your reviewer:

/hold will add in details about key generation when I'm back at the laptop

Steps (adapted from https://github.com/sigstore/cosign#installation and https://github.com/sigstore/cosign/blob/main/KMS.md):

1. Get cosign:

   go install github.com/sigstore/cosign/cmd/[email protected]

2. Check which account you're operating over:

   gcloud config configurations list
   NAME         IS_ACTIVE  ACCOUNT                    PROJECT             COMPUTE_DEFAULT_ZONE  COMPUTE_DEFAULT_REGION
   ...
   releng-prod  True       [email protected]             k8s-releng-prod

3. Generate GOOGLE_APPLICATION_CREDENTIALS:

   gcloud auth application-default login
   
   export GOOGLE_APPLICATION_CREDENTIALS="/Users/augustus/.config/gcloud/application_default_credentials.json"

4. Generate a signing key on GCP KMS

   I did this via the console using these instructions.

   Here are the specs on the key:

   • type: generated key
   • name: cosign-test-0
   • protection level: HSM
   • purpose: asymmetric sign
   • key type and algorithm: elliptic curve P-256 / SHA256 digest

5. Generate cosign.pub:

   (Special step)
   Make sure you actually have permissions to sign/verify on GCP KMS: infra/gcp: Grant Release Manager Admins roles/cloudkms.signerVerifier k8s.io#2614

   ~/go/bin/cosign -d generate-key-pair -kms gcpkms://projects/k8s-releng-prod/locations/global/keyRings/release/cryptoKeys/cosign-test-0
   2021/08/25 15:38:40 Key ring projects/k8s-releng-prod/locations/global/keyRings/release already exists in GCP KMS, moving on to creating key.
   Public key written to cosign.pub

6. Check the key:

   cat cosign.pub
   -----BEGIN PUBLIC KEY-----
   MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwbFSNTX481zrRduH3nu8HQ6hHhSW
   KEPjaz/SlBr+SojMXgYJsSueIRqfLiCJgNcdqEe1gXk70WZRHtAHfVzTNw==
   -----END PUBLIC KEY-----

Does this PR introduce a user-facing change?

- cosign: Add a public key for testing
  Preliminary steps to sign/verify artifacts via `cosign`.
  The process or needs will evolve over time, so we've opted to generate
  a "test" key to start.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justaugustus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[puerco]

/lgtm

[justaugustus]

/hold cancel
FYI @kubernetes/release-engineering @dlorenc @lukehinds

[cpanato]

thanks!