Publish cosign bundle alongside qcow2 files

.github/workflows/build_test_images.yaml

@@ -27,6 +27,10 @@ jobs:
       matrix:
         include: ${{ fromJson(needs.read_builds.outputs.builds) }}
     name: ${{ matrix.name }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write # needed for signing the images with GitHub OIDC Token
     steps:
       - name: Check out the repository
         uses: actions/checkout@v3
@@ -53,6 +57,9 @@ jobs:
           PACKER_TEMPLATE: ${{ matrix.template }}
           ENV_VAR_FILES: ${{ matrix.var-files }}
 
+      - name: Install cosign
+        uses: sigstore/[email protected]
+
       - name: Publish image
         id: publish-image
         run: ./bin/publish-image
@@ -73,6 +80,7 @@ jobs:
             name: ${{ steps.publish-image.outputs.image-name }}
             url: ${{ steps.publish-image.outputs.image-url }}
             checksum: ${{ steps.publish-image.outputs.image-checksum }}
+            cosign-bundle-url: ${{ steps.publish-image.outputs.cosign-bundle-url }}
             manifest-extra: ${{ steps.build-image.outputs.manifest-extra }}
 
   publish_manifest:

bin/publish-image

@@ -26,6 +26,16 @@ else
     "$IMAGE_SOURCE_FILE" \
     "${IMAGE_NAME}.qcow2"
 fi
+# output the image size for debug reasons
+ls -alh "${IMAGE_NAME}.qcow2"
+
+# create signature
+cosign sign-blob "${IMAGE_NAME}.qcow2" --bundle "${IMAGE_NAME}.cosign.bundle" -y
+
+# test the bundle works validates
+cosign verify-blob "${IMAGE_NAME}.qcow2" --bundle "${IMAGE_NAME}.cosign.bundle" \
+  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
+  --certificate-identity-regexp="https://github.com/stackhpc/azimuth-images/.github/.*"
 
 # Upload the compressed image to S3
 cat <<EOF > ~/.s3cfg
@@ -38,14 +48,18 @@ signurl_use_https = True
 EOF
 s3cmd mb "s3://$S3_BUCKET"
 s3cmd put "${IMAGE_NAME}.qcow2" "s3://$S3_BUCKET"
+s3cmd put "${IMAGE_NAME}.cosign.bundle" "s3://$S3_BUCKET"
 
 # Make a signed link that lasts for one year
 IMAGE_URL="$(s3cmd signurl "s3://$S3_BUCKET/${IMAGE_NAME}.qcow2" +31536000)"
 
+COSIGN_BUNDLE_URL="$(s3cmd signurl "s3://$S3_BUCKET/${IMAGE_NAME}.cosign.bundle" +31536000)"
+
 # Get the checksum of the image
 IMAGE_CHECKSUM="sha256:$(sha256sum "${IMAGE_NAME}.qcow2" | awk '{ print $1 }')"
 
 # Produce outputs
 echo "image-name=$IMAGE_NAME" >> "${GITHUB_OUTPUT:-/dev/stdout}"
 echo "image-url=$IMAGE_URL" >> "${GITHUB_OUTPUT:-/dev/stdout}"
 echo "image-checksum=$IMAGE_CHECKSUM" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "cosign-bundle-url=$COSIGN_BUNDLE_URL" >> "${GITHUB_OUTPUT:-/dev/stdout}"