Code sign releases

[jzelinskie]

We currently do not do any code signing.

It wouldn't be much work to adopt what's done in this thread (e.g. how in-toto signs releases), using cosign with goreleaser.

[jzelinskie]

Here's another post with more information on the cosign/goreleaser workflow: https://shibumi.dev/posts/keyless-signatures-with-github-actions/

[jzelinskie]

Here's some more posts on how to do it for our docker images:

• https://chainguard.dev/posts/2021-12-01-zero-friction-keyless-signing
• https://github.blog/2021-12-06-safeguard-container-signing-capability-actions/

[jzelinskie]

An example repository using goreleaser: https://github.com/caarlos0-graveyard/gorel-keyless