Think about signing the built container images

[zmiklank]

Investigate, if sigstore can be used for signing the images and if the idea makes sense.

[zmiklank]

The signature can be created with GitHub Action and then stored in the container registry.
Quay already supports the sigstore, as it is based on OCI, however only from version 3.6 and quay.io yet wasn't upgraded to this version (but will be).
When the quay.io supports the sigstore we could sign our containers, and ship them signed.
The authentication of the signer is done via the OpenID connect

[phracek]

@vrothberg is working on a project with signing containers. We can be a pioneers :) https://github.com/sigstore/cosign

[vrothberg]

Thanks for the ping. Yes, we are working on integrating sigstore/cosign support into the container tools (Skopeo, Podman, Buildah).