Signing SBOMs in workflows

[lefosg]

To provide transparency in the supply chain of the release, cosign (a client for Sigstore) is used to sign the SBOM. It is now common to provide signed artifacts and later on, before deployment, verify the SBOM's signature. This ensures integrity and authenticity (the SBOM has not been tampered with and, only authorized entities - the GitHub runner - produces/signs the SBOM)

Changes

Added two steps in the auto-release.yml, right after generating the SBOM, before commiting the changes.

It is easy to reproduce locally. Install cosign. Download the release. Run the two commands added in the attest sbom step. The first command (cosign sign-blob) should produce two files. As a sanity check, the second command verifies the signature, plus that the entity that signed is indeed the GitHub runner.

Checklist:

• [ X ] I have tested my changes. No regression in existing tests.
• [ X ] I have modified and/or added unit-tests to cover the code changes in this Pull Request.

Related Issue

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ActoryOu]

Hi @lefosg,
Thank you for bringing this to us! I'll reach the team to review this.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.53%. Comparing base (60f34f8) to head (4bc8d25).
⚠️ Report is 36 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1281      +/-   ##
==========================================
- Coverage   91.59%   91.53%   -0.06%     
==========================================
  Files           6        6              
  Lines        3259     3261       +2     
  Branches      902      904       +2     
==========================================
  Hits         2985     2985              
  Misses        132      132              
- Partials      142      144       +2     

Flag	Coverage Δ
unittests	91.53% <ø> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[kstribrnAmzn]

Thank you for the contribution @lefosg ! As a matter of security we are typically weary of externally owned Github actions - especially ones that themselves are helping implement security. I understand the need for signing our releases. Would you be open to the idea of us signing our entire release (including SBOM) or us signing our own SBOM (without cosign)?