feat: validates signatures against the images if they exist in the images spec

[waveywaves]

Description

Validate images using cosign signatures if they exist in the images spec

Related Issue

Fixes #2257

Relates to #

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	ae16a03
🔍 Latest deploy log	https://app.netlify.com/sites/zarf-docs/deploys/65d75a96c395190008523198

[waveywaves]

Would we have to pull the image down and then use that blob to use for the verification
Also another question about cosign.pub. From what I understand providing a local cosign.pub is deprecated (?). Would a user have to provide another public key for verification using a env var or a flag during package create or something else.

cc @Racer159

[Racer159]

Would we have to pull the image down and then use that blob to use for the verification Also another question about cosign.pub. From what I understand providing a local cosign.pub is deprecated (?). Would a user have to provide another public key for verification using a env var or a flag during package create or something else.

cc @Racer159

The cosign.pub verification to my understanding isn't deprecated (would be interesting to see where you saw that - I don't see anything in cosign running locally), but also isn't the primary method to verify cosign signatures because it doesn't use the more modern keyless infrastructure. For Zarf's use cases though (working in an airgap/offline) we have largely supported the cosign keys since they are much easier to take into airgaps to perform verification.

This particular issue may require more design though before we can tackle it (it was originally split from an issue that had a few separate issues in it) since there are a few scenarios we should consider. Many organizations may have a common key they resign things with in a registry mirror like artifactory but there would likely be many more that would want to manage different keys or different verification schemes for their images (i.e. if they had images from multiple sources or teams). CC @eddiezane for his thoughts on this as well.

[waveywaves]

@Racer159 saw that cosignPublicKeyPath was deprecated here

https://github.com/defenseunicorns/zarf/blob/main/src/types/component.go#L34-L35