Signed container images with buildah, podman and cosign via GitHub Actions
All the Toolbx and Distrobox container images and the ones in my personal namespace on Quay.io are now signed using cosign. How to set this up was not really well documented so this post is an attempt at that. First we will look at how to setup a GitHub workflow using GitHub Actions to build multi-architecture container images with buildah and push them to a registry with podman. Then we will sign those images with cosign (sigstore) and detail what is needed to configure signature validation on the host. Finally we will detail the remaining work needed to be able to do the entire process onl...
Source: tim.siosm.fr
