Sign releases with cosign

[mattmoor]

Actual behavior

If I try to use the upstream kaniko images with cosigned enabled, the build pods are rejected.

Expected behavior

The upstream releases should be signed against the Fulcio root, so that folks can verify their signature.

Distroless does this with GCB here: https://github.com/GoogleContainerTools/distroless/blob/57231e548132eaef221708f0b7d46762efae9e42/cloudbuild.yaml#L71

I'd recommend following exactly this pattern if we can (incl. the serviceaccount name).

cc @priyawadhwa @dlorenc

[priyawadhwa]

Sgtm!

The only issue rn is that it looks like kaniko GCB builds have been broken for a few months now so images aren't being released or signed 😕 i'll try and get #1741 merged which might fix it 🤞🏽

[MFTabriz]

@priyawadhwa seems like even after the merge it's still not working correctly.

[aaron-prindle]

Releases are signed with cosign now as noted in the kaniko README.md docs - https://github.com/GoogleContainerTools/kaniko/blob/main/README.md#verifying-signed-kaniko-images

Closing