docs: ADR for signatures, sigstore and GPG

[ctron]

Rendered version: https://github.com/ctron/trustify/blob/feature/adr_check_sig_1/docs/adrs/00005-signatures.md

Also see: https://issues.redhat.com/browse/TC-1174

[carlosthe19916]

Looks great.

• In terms of how it would look like for users, I think we could somehow copy the Github way of rendering signed commits.
  • I also wonder if in the UI there should be visibility of the keys used to verify signature? Something only an "Admin" should be able to see. Asking just in case a dedicated REST API would be needed to expose this information.
• In regards of the Upload REST API. I wonder how an SBOM and its signature will be uploaded? I might be wrong but I guess the SBOM and its signature are 2 different files, should/can they be uploaded together?

[ctron]

Looks great.

• In terms of how it would look like for users, I think we could somehow copy the Github way of rendering signed commits.

  • I also wonder if in the UI there should be visibility of the keys used to verify signature? Something only an "Admin" should be able to see. Asking just in case a dedicated REST API would be needed to expose this information.

I think it would be great finding a way to properly expose this through the UI to the user. And also, allow users to manages this through the UI.

• In regards of the Upload REST API. I wonder how an SBOM and its signature will be uploaded? I might be wrong but I guess the SBOM and its signature are 2 different files, should/can they be uploaded together?

It depends. One source might be "sigstore", in which case the system would need to fetch from that source. The question would be: how would be user define if this document is applicable to that sigstore source. If there's more than one.

The second source, would be the SBOM/advisory source. Which in this case, would be the upload form. So, the user should have the ability to upload the signature too. Only works on the order of: document first, signature next. Maybe it makes sense capturing that process in a UI flow. Can be a combined form. Could be a two step process too. Again the user would need to tell the system which trust anchors are applicable.