[Spike] Investigate use of cosign for CNG images
Summary
Image signing requires further investigation into:
- whether we can do and use that with the gitlab container registry, considering gitlab-org/gitlab#338682 (closed) seems still pending
But it just means we need an investigation spike. As its very possible cosign for example will already work if we start signing, just not be easily visible from the container registry UI.
Outcomes
-
Record findings in this issue -
If feasible, Log new issues that represent deliverable iterations of the work