[enhancement]: sign container artifacts

[wwest4]

Which feature or improvement would you like to request?

I'd like to see this feature: sign container artifacts with DCT, cosign, or something else.

Currently:

DOCKER_CONTENT_TRUST=1 ; docker pull stalwartlabs/mail-server
Using default tag: latest
Error: remote trust data does not exist for docker.io/stalwartlabs/mail-server: notary.docker.io does not have trust data for docker.io/stalwartlabs/mail-server

Probably worth mentioning that not all container runtimes support DCT, but anything would be better than nothing.

In the meantime folks can just build from source using the Dockerfile in the repo to get equivalent assurance of authenticity, it's just less than ideal. TIA.

Is your feature request related to a problem?

I'm having a problem with...

Code of Conduct

• I agree to follow this project's Code of Conduct

[williamdes]

Ref: #1033
The original discussion
Where I had said

See https://github.com/sudo-bot/action-docker-sign/ and all the documentation I built in the recent years

[mdecimus]

This is covered by #561