Add cosign signing on build

[Itxaka]

Signed-off-by: Itxaka [email protected]

[Itxaka]

blocked by #817 as we need cosign and luet-cosign as deps

[Itxaka]

Keyless signing test: https://github.com/Itxaka/test-oidc-signing/runs/4019264117?check_suite_focus=true

pushed signature can be verified with COSIGN_EXPERIMENTAL=1 cosign verify itxaka/test:latest

Pretty straighforward

[Itxaka]

Ready for review @mudler

After the test with github keyless and the manual test with keys, this should be good to go for the part of signing the images during build.

NOTE: This currently pushes the signatures to the old dockerhub repo raccos/releases-flavor which we should create beforehand (old repos used the distro names, while we use the flavors). @mudler could you create the required repos (raccos/releases-{green,blue,orange}) ?

[mudler]

Ready for review @mudler

After the test with github keyless and the manual test with keys, this should be good to go for the part of signing the images during build.

NOTE: This currently pushes the signatures to the old dockerhub repo raccos/releases-flavor which we should create beforehand (old repos used the distro names, while we use the flavors). @mudler could you create the required repos (raccos/releases-{green,blue,orange}) ?

@Itxaka Do we need each repo for each arch?

[mudler]

Beautiful integration 💯

[Itxaka]

@Itxaka Do we need each repo for each arch?

@mudler not really, but its mainly to keep with the current status of separating artifacts per repo, I dunno. Can be changed, but it should be done now. Do you prefer just one repo? raccos/release-signatures or something similar?