[WIP] Verify Kubernetes components with cosign

[3u13r]

Proposed change(s)

This is currently block until Kubernetes 1.26 is released, since it is the first version with signed binaries.

Checklist

• Update CHANGELOG.md
• Update docs
• Link to Milestone

[netlify]

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	a708376
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/650adb518c02000008fbe56d

[datosh]

The sigstore/sigstore project can be used to programmatically check signatures.

We already depend on it in internal/sigstore/verify.go. Maybe you can use or adapt the code that is there?

[3u13r]

The sigstore/sigstore project can be used to programmatically check signatures.

We already depend on it in internal/sigstore/verify.go. Maybe you can use or adapt the code that is there?

Thanks for the hint, I'll give it a try.

[malt3]

This is now finalized: https://kubernetes.io/blog/2022/12/12/kubernetes-release-artifact-signing/