[WIP] Verify Kubernetes components with cosign

[3u13r]

Proposed change(s)

This is currently block until Kubernetes 1.26 is released, since it is the first version with signed binaries.

Checklist

• [ ] Update CHANGELOG.md
• [ ] Update docs
• [ ] Link to Milestone

[netlify[bot]]

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	a70837616d564665c2d7aadc1d224e8f4d4c8267
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/650adb518c02000008fbe56d

[datosh]

The sigstore/sigstore project can be used to programmatically check signatures.

We already depend on it in internal/sigstore/verify.go. Maybe you can use or adapt the code that is there?

[3u13r]

The sigstore/sigstore project can be used to programmatically check signatures.

We already depend on it in internal/sigstore/verify.go. Maybe you can use or adapt the code that is there?

Thanks for the hint, I'll give it a try.

[malt3]

This is now finalized: https://kubernetes.io/blog/2022/12/12/kubernetes-release-artifact-signing/