ci: ensure all the images we built are signed with cosign

Prior to this commit, we did NOT sign the container images built by our
pipelines. We only signed the artifacts attached to the final GitHub
release (like the SBOM and the provenance file).

With this commit we sign (using both cosign v2 and v3 formats):
- architecture specific images
- multi-arc image manifest

Currently we support only amd64 images.

Co-authored-by: Flavio Castelli <fcastelli@suse.com>
Signed-off-by: Sam Wang (holyspectral) <sam.wang@suse.com>

Author: holyspectral

.github/workflows/container-build.yml

@@ -22,10 +22,13 @@ jobs:
     permissions:
       contents: read
       packages: write # Pushing images to ghcr.io
+      id-token: write # Signing images with cosign
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Install cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Login to GitHub Container Registry
@@ -53,6 +56,28 @@ jobs:
           tags: ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}
           outputs: |
             type=image,push=true,push-by-digest=true,name-canonical=true
+
+      # We need to disable the new bundle format enabled by default since
+      # cosign v3.x.x because some verification tools (e.g. slsactl, hauler and old
+      # cosign) are not able to properly verify the signatures using this
+      # new format
+      - name: Sign container image with cosign v2 signature format
+        run: |
+          cosign sign --yes --new-bundle-format=false --use-signing-config=false \
+            ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${{ steps.build-image.outputs.digest }}
+
+      - name: Sign container image with cosign v3 signature format
+        run: |
+          cosign sign --yes --new-bundle-format=true --use-signing-config=true \
+            ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${{ steps.build-image.outputs.digest }}
+
+      - name: Verify container image signature
+        run: |
+          cosign verify \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+            --certificate-identity="https://github.com/${{github.repository_owner}}/runtime-enforcer/.github/workflows/container-build.yml@${{ github.ref }}" \
+            ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${{ steps.build-image.outputs.digest }}
+
       - name: Export digest
         run: |
           mkdir -p ${{ runner.temp }}/digests
@@ -70,6 +95,7 @@ jobs:
     needs: [build]
     permissions:
       packages: write # Pushing multi-arch manifest to ghcr.io
+      id-token: write # Signing images with cosign
     strategy:
       matrix:
         component: [operator, daemon]
@@ -80,7 +106,8 @@ jobs:
           path: ${{ runner.temp }}/digests
           pattern: digest-${{ matrix.component }}-*
           merge-multiple: true
-
+      - name: Install cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
       - name: Login to GHCR
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
@@ -105,13 +132,55 @@ jobs:
         id: create-manifest
         working-directory: ${{ runner.temp }}/digests
         run: |
+          set -e
           amd64_digest=$(cat ${{ matrix.component }}-amd64.txt)
 
+          # Create the manifest locally
+          docker buildx imagetools create \
+            -t ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}:${{ env.TAG_NAME }} \
+            ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${amd64_digest} \
+            --dry-run > expected-multi-arch-manifest.json
+
+          # Create the manifest and push it
           docker buildx imagetools create \
             -t ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}:${{ env.TAG_NAME }} \
             ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${amd64_digest} \
 
-          docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}:${{ env.TAG_NAME }}
+          # The previous command is NOT printing the digest of the multi-arch manifest, we have to obtain it by
+          # fetching it from the OCI registry and **verify** its contents before signing it
+
+          # Fetch the multi arch manifest
+          docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}:${{ env.TAG_NAME }} \
+            --raw > multi-arch-manifest.json
+          multi_arch_manifest_digest="sha256:$(sha256sum multi-arch-manifest.json | awk '{print $1}')"
+
+          # Compare the contents of the manifest we previously computed and the actual one.
+          # Use jq to sort the contents and build a compact output (removing useless whitespaces),
+          # this is done to ensure the JSON documents have the same structure.
+          expected_digest="sha256:$(jq -S -c . expected-multi-arch-manifest.json | sha256sum | awk '{print $1}')"
+          actual_digest="sha256:$(jq -S -c . multi-arch-manifest.json | sha256sum | awk '{print $1}')"
+
+          if [ "$expected_digest" != "$actual_digest" ]; then
+            echo "Error: digests do not match!"
+            exit 1
+          fi
+
+          # Sign the multi-arch image manifest using cosign v2 format
+          cosign sign --yes --new-bundle-format=false --use-signing-config=false \
+            ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${multi_arch_manifest_digest}
+
+          # Sign the multi-arch image manifest using cosign v3 format
+          cosign sign --yes --new-bundle-format=true --use-signing-config=true \
+            ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${multi_arch_manifest_digest}
+
+          echo "MULTI_ARCH_MANIFEST_DIGEST=$multi_arch_manifest_digest" >> $GITHUB_ENV
+
+      - name: Verify multi-arch manifest signature
+        run: |
+          cosign verify \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+            --certificate-identity="https://github.com/${{github.repository_owner}}/runtime-enforcer/.github/workflows/container-build.yml@${{ github.ref }}" \
+            ghcr.io/${{ github.repository_owner }}/runtime-enforcer/${{ matrix.component }}@${{ env.MULTI_ARCH_MANIFEST_DIGEST}} 
 
   attest:
     needs: [merge]