Sign release artefacts using cosign

[cpanato]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area build

What this PR does / why we need it:

Sign the release artefacts using cosign and also generate the SBOM using syft for now

the secret key is already set in circleci

/assign @leogr @Issif
cc @danpopnyc

Which issue(s) this PR fixes:

Fixes #300

Special notes for your reviewer:

[leogr]

SGTM, but I can't try it.

@Issif @cpanato do we want to merge it directly and see what happens?

[cpanato]

@leogr I've run in a sample repo the commands and that worked :)

let's try, what we can do is when we cut the release, I will be watching to check and if fail can act right away

@Issif

[Issif]

I think I will work on the new release this month, I would to manage source and tags in payload first, this is important because of plugins and talon, but this is a big work as we have many outputs

[Issif]

@cpanato I created the PR for dealing with source and tags in the events, feel free to rebase this PR on it after

[leogr]

@cpanato I created the PR for dealing with source and tags in the events, feel free to rebase this PR on it after

There are no conflicts. I guess we can approve this PR. @Issif is that ok for you?

[cpanato]

i can rebase just to make sure, one sec

[cpanato]

@leogr @Issif rebased

[Issif]

❤️

[poiana]

LGTM label has been added.

Git tree hash: 6fb279971631c5d5763edabc1feb874be85e92ee

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cpanato, Issif

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Issif,cpanato]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cpanato]

@Issif when you cut let me know in case we need to tweak anything :)

[Issif]

@Issif when you cut let me know in case we need to tweak anything :)

I'll ask you to review the PR for the next release anyway 😉