added cosign and provenance generation

[garethahealy]

Added the ability to generate provenance of how the packaged chart was created by using the GitHub SLSA generator and added the ability to sign the tgz.

tested via this pipeline:

• https://github.com/garethahealy/helm-charts/actions/runs/7388100361/job/20098200882

the end result:

• you can verify the provenance of how the chart was packaged (https://search.sigstore.dev/?uuid=24296fb24b8ad77a7c0aa4003ad53787135583692bd4e2f247e152d9853a9e73e0f5c20c042d403c)
• you can verify the signed chart (https://search.sigstore.dev/?logIndex=60881562)

if a consumer of the chart, wants to make sure the tgz they've got is the same as the one packaged via the pipeline, they can:

$ brew install rekor-cli
$ rekor-cli get --log-index 60881562 --format json | jq -r '.Body.HashedRekordObj.signature.content'  > jenkins.tgz.sig
$ rekor-cli get --log-index 60881562 --format json | jq -r '.Body.HashedRekordObj.signature.publicKey.content' | base64 -d > pub.crt

$ cosign verify-blob --certificate pub.crt --signature jenkins.tgz.sig --certificate-identity https://github.com/garethahealy/helm-charts/.github/workflows/release.yaml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com jenkins-1.0.13.tgz

cc: @redhat-cop/day-in-the-life

[garethahealy]

@sabre1041 ; interested if you've got any feedback on this. i looked at the helm plugin but that didn't seem super active and also required generating pgp keys, which I don't want to have to do as part of this pipeline.

[garethahealy]

@ckavili ; happy to have a chat to explain this, if its not clear

[ckavili]

@ckavili ; happy to have a chat to explain this, if its not clear

I think we are good! I used helm sign... and the plug-in you mentioned before but yeah, I wouldn't want to get into gpg keys as well 🫣🙈 unless Andy has other suggestions, I'd just say maybe we can add the verification part to README for people who are interested in and then we are good🙃

[sabre1041]

@garethahealy the goal of the plugin was to provide a bridge for transparency with the existing signing methods of Helm so it could take advantage of Rekor as well as not be tied to OCI to store charts.

If neither are necessary, simple sigstore/cosign signing is all you need

[eformat]

LGTM .. lets try this out @garethahealy !

[eformat]

@garethahealy .. think this can be ignored ..

https://github.com/redhat-cop/helm-charts/actions/runs/7481237987/job/20362415933

let me merge a renovate one .. see what happens ...

[eformat]

looks good

-- this merge
https://github.com/redhat-cop/helm-charts/actions/runs/7481278289

-- provenance generator
https://github.com/redhat-cop/helm-charts/actions/runs/7481278289/job/20362563577

-- sigstore entry
https://search.sigstore.dev/?uuid=24296fb24b8ad77a920afa1cc4788e9f180a49cdd2d86bfc57dfa73258269a56e697b68f8fb17b3c

[ckavili]

ohh very nice! 😍

[eformat]

🥳🎉👯‍♀️