SHIP-0042: Trusted certificates

[sayan-biswas]

Proposal to add a Shipwright feature to use trusted certificates in Build steps.

Changes

Submitter Checklist

• Includes tests if functionality changed/was added
• Includes docs if changes are user-facing
• Set a kind label on this PR
• Release notes block has been filled in, or marked NONE

See the contributor guide
for details on coding conventions, github and prow interactions, and the code review process.

Release Notes

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign adambkaplan for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[adambkaplan]

Initial comments since this proposal is in the draft state. I'd like to see the scope of this proposal more clearly defined before accepting it in the "provisional" state.

[adambkaplan]

I like that we are supporting multiple certificates - this enables more fine grained distribution of trust.

I am concerned that the naming "certificates" is too broad. Are we concerned with certificate authorities for TLS verficiation? X.509 certificates for workload identity? Mutual TLS certificates between services? These are all very different things that utilize similar underlying fundamental technologies.

[sayan-biswas]

I think we are only concerned about X.509 certificates here.