STAC-22594 Documented how to verify signature of docker images

[LukaszMarchewka]

No description provided.

[netlify]

✅ Deploy Preview for suse-obs ready!

Name	Link
🔨 Latest commit	73593d5
🔍 Latest deploy log	https://app.netlify.com/projects/suse-obs/deploys/6aaa4ed86a08c50008c2288d
😎 Deploy Preview	https://deploy-preview-404--suse-obs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[viliakov]

Suggested change

	Image signing was added to our build pipeline recently. Images published before this was rolled out do not carry a signature — verifying one of those tags fails with `no signatures found`, which does not indicate a problem with the image itself. If you rely on signature verification, pull a current tag.
	Image signing was introduced for platform images in release vX.Y.Z and for agent images in release vA.B.C.. Images published before this was rolled out do not carry a signature — verifying one of those tags fails with `no signatures found`, which does not indicate a problem with the image itself. If you rely on signature verification, pull a current tag.

[akashraj4261]

Suggested change

	{stackstate-product-name} container images are cryptographically signed during the build pipeline using https://www.sigstore.dev/[Sigstore] keyless signing (`cosign`). Verifying a signature confirms that an image was genuinely built by our CI from a specific source repository, workflow, and branch or tag — before you pull it into a cluster.
	{stackstate-product-name} container images are cryptographically signed during the build pipeline using link:https://www.sigstore.dev/[Sigstore] keyless signing (`cosign`). Verifying a signature confirms that an image was genuinely built by our CI from a specific source repository, workflow, and branch or tag — before you pull it into a cluster.

[akashraj4261]

Minor comments

[l4zy0n3]

$ cosign verify \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github.com/StackVista/.*' \
  registry.rancher.com/suse-observability/stackstate-ui:2.11.1

Verification for registry.rancher.com/suse-observability/stackstate-ui:2.11.1 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":{"identity":{"docker-reference":"registry.rancher.com/suse-observability/stackstate-ui:2.11.1"},"image":{"docker-manifest-digest":"sha256:6eb468d98c7d995aba410267e6da1d91a24b4ec0f2c8f57ba2b60cf536c8ce0f"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":{}}]

$ cosign verify \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github.com/StackVista/.*' \
  registry.rancher.com/suse-observability/stackstate-k8s-agent:158e1098

Verification for registry.rancher.com/suse-observability/stackstate-k8s-agent:158e1098 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":{"identity":{"docker-reference":"registry.rancher.com/suse-observability/stackstate-k8s-agent:158e1098"},"image":{"docker-manifest-digest":"sha256:35e66696a1bdc0d470e0d11d7711e426548a09d31190bdd94cd1350b464dc839"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":{}}]