Sign released images

[imjasonh]

Changes

Progress toward #907

This also annotates the signature with the commit SHA and GitHub run ID and attempt number (in case there are multiple attempts), so consumers can trace back to the workflow run that produced the image and signature.

/kind feature

Submitter Checklist

• Includes tests if functionality changed/was added
• Includes docs if changes are user-facing
• Set a kind label on this PR
• Release notes block has been filled in, or marked NONE

See the contributor guide
for details on coding conventions, github and prow interactions, and the code review process.

Release Notes

Released images are signed with an ephemeral key using cosign

[imjasonh]

I'd like to propose this before the next upcoming release. Nightly releases have been signed for a month or so without any issue AFAIK. Any concerns with signing the next release?

[imjasonh]

PIng @adambkaplan @SaschaSchwarze0 any concerns with this?

I see in shipwright-io/community#45 that the code freeze for the next build release may be tomorrow?

[SaschaSchwarze0]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: SaschaSchwarze0

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [SaschaSchwarze0]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[adambkaplan]

/lgtm

I think we should cut a "release candidate" tomorrow so that the cli, website, and operator can get a head start syncing content. Let's use this as an opportunity to verify the image signature!