Enable SIgned Releases

[VedRatan]

https://clomonitor.io/docs/topics/checks/#signed-releases-from-openssf-scorecard

See: #536

[VedRatan]

@liamfallon @johnbelamaric we can enable signed releases by following the steps mentioned over here

[nyrahul]

Hey @VedRatan, it would be better to sign the container images using cosign so that we do not depend on Github specific signing/logs infrastructure. Cosign and corresponding transparency logs are maintained by Sigstore and this is backed by Open SSF.

I would bring this up in the Rx Scope discussion meeting tomorrow.

[nyrahul]

We hd this discussed in the Nephio Developer Summit.
The aim is to leverage cosign for image signign .. The flow is as follows.

[radoslawc]

Hi! @nyrahul and @VedRatan we're signing released images since first release using cosign just not using ephemeral keys but a fixed key. Signature is uploaded as artifact to docker hub, for example:
here's vlan-fn image for release v2.0.0:
https://hub.docker.com/repository/docker/nephio/vlan-fn/tags?page=&page_size=&ordering=&name=v2.0.0
and corresponding signature, sbom and security scan results are uploaded as artifacts
https://hub.docker.com/repository/docker/nephio/vlan-fn/tags?page=&page_size=&ordering=&name=22e6b
with name being image sha and extensions respectively *.sig, *.sbom and *_scan.txt
Public key is on wiki: https://wiki.nephio.org/display/HOME/Code+signing
This process is for now manual and for sure can be improved so I believe we should join our forces to work on that.

[anurag-rajawat]

Hi @radoslawc I would like to work on this.

[anurag-rajawat]

Hey @radoslawc,
Based on my understanding, to automate the image signing using cosign as part of release pipeline, we'd need to:

• Update release.sh and Dockerfile to incorporate cosign for signing the images.
• Add a separate cosign container (built in previous step) in the postsubmit jobs in prow configs, something like:

postsubmits:
  nephio-project/free5gc:
   - name: build-push-image-free5gc-operator-release-conf
     ...
     ...
      containers:
      ...
      - name: cosign
        image: ttl.sh/cosign:24h
        args:
          - nephio/free5gc-operator:${PULL_BASE_REF}
        env:
          - name: COSIGN_PRIVATE_KEY
            valueFrom:
              secretKeyRef:
                name: cosign-private-key
                key: COSIGN_PRIVATE_KEY
          - name: COSIGN_PASSWORD
            valueFrom:
              secretKeyRef:
                name: cosign-private-key-passwd
                key: COSIGN_PASSWORD
...

Is my understanding correct?