feat: add base image verification

[xynydev]

Are these things, that are in the the startingpoint action, missing from here, or are they implemented in blue-build/cli (@gmpinder) ?

• Check SIGNING_SECRET matches cosign.pub
• Verify base image
• Generate tags
• Lowercase Registry & Image

[gmpinder]

• Check SIGNING_SECRET matches cosign.pub - https://github.com/blue-build/cli/blob/dbbd087b5ba3dc7a6bf8f3fa9be2cdb569d6cecb/src/commands/build.rs#L762
• Verify base image - NOPE! Needs to be done
• Generate tags - https://github.com/blue-build/cli/blob/dbbd087b5ba3dc7a6bf8f3fa9be2cdb569d6cecb/src/commands/template.rs#L64
• Lowercase Registry & Image - I don't think so, good idea to fix and easy to implement

[gmpinder]

Lowercase registry is being fixed here: blue-build/cli#8

[xynydev]

Should the image verification be implemented here with EyeCantCU's action (easy), or in cli?

[gmpinder]

Should the image verification be implemented here with EyeCantCU's action (easy), or in cli?

If it just involves inspecting it for a label, we can totally do that in the tool. Plus I'll need that to make sure we're using the right version number on the image instead of latest

[RoyalOughtness]

FYI, not only is base image verification needed but also custom base image verification, if using EyeCantCU's action:

  - name: Verify base image
        if: ${{ ! contains(env.IMAGE_NAME, 'wayblue') }}
        uses: EyeCantCU/cosign-action/[email protected]
        with:
          containers: ${{ env.BASE_IMAGE_NAME }}:${{ env.IMAGE_MAJOR_VERSION }}

      - name: Verify base image
        if: ${{ contains(env.IMAGE_NAME, 'wayblue') }}
        uses: EyeCantCU/cosign-action/[email protected]
        with:
          containers: ${{ env.BASE_IMAGE_NAME }}:${{ env.IMAGE_MAJOR_VERSION }}
          registry: 'ghcr.io/wayblueorg'
          pubkey: 'https://raw.githubusercontent.com/wayblueorg/wayblue/live/cosign.pub'

Regardless, the registry and pubkey need to be available as parameters.

[xynydev]

I could implement this based on EyeCantCU's PR on startingpoint first, since this isn't a priority to implement in cli.

[xynydev]

We should probably have a list of keys to verify against by default, at least ublue and upstream fedora and vanilla (if those use cosign, haven't checked yet). I'm also unsure how to handle OIDC here.