Sign base image and krkn-hub scenario images in CI (cosign, key-based) #1587

Context

Build/CI side of the ecosystem-wide image signing/verification flow (main issue: krkn-chaos/krknctl#180). krkn builds the base image and the krkn-hub scenario images; these are the images the operator and krknctl execute, so they must be signed here so the consumers can verify them.

One-time setup

• Generate a cosign key pair: cosign generate-key-pair ⇒ cosign.key (private, password-encrypted) + cosign.pub (public).
• Store the private key as GitHub secret COSIGN_PRIVATE_KEY and its password as COSIGN_PASSWORD.
• Commit cosign.pub and share it with the shared verify package (krknctl/pkg/verify, embedded via go:embed) — single source of truth for the public key.

In the build/release workflow

For the base image and every krkn-hub scenario image, after build + push:

1. Resolve the image digest (from the push output or crane digest).
2. Sign the digest (not the tag), offline (no Rekor):

   COSIGN_PASSWORD=... cosign sign --key env://COSIGN_PRIVATE_KEY --tlog-upload=false --yes <image>@<digest>
   

3. Multi-arch: sign the index digest.

Notes

• Key-based + --tlog-upload=false keeps the whole flow offline (no Fulcio/Rekor), matching the air-gap requirement.
• Air-gap mirroring is documented on the krknctl/operator side (must use cosign copy so the .sig travels with the image).

Related to main issue: krkn-chaos/krknctl#180.