Automatic signing

[varunsh-coder]

Would you like harden-runner to automatically sign your build artifact? Signing releases is a Scorecards requirement, but is hard to do.

@jauderho has created a sample workflow for key-less signing and SBOM generation here:
https://github.com/jauderho/dockerfiles/blob/main/.github/workflows/age.yml
https://github.com/jauderho/dockerfiles/actions/runs/1755633128

[jauderho]

So I've noticed that the cosign process is creating additional entries on the registries causing my shields.io badge to not display properly.

It's unclear to me right now if it is something I'm doing incorrectly, the shields team will have to filter out or new functionality that registries will have to support/implement.

More information captured here: docker/roadmap#269 (comment)

[jauderho]

Now tracking my findings here: jauderho/dockerfiles#149