[UMBRELLA] Publish supply chain security artifacts during the release

[maxgio92]

Describe the feature

This is a security feature on the distribution of the Capsule OCI image artifact. Security artifacts can help secure the supply chain by providing ways for consumers to verify the authenticity of the artifacts provided by the project, the integrity of the artifacts.

What would the new user story look like?

As an end-user of Capsule, I'd like to verify the authenticity and integrity of artifacts officially provided by the Capsule project.

Expected behavior

• [ ] Provide OCI image's signature
• [ ] Provide SBOM of the artifacts
• [ ] Provide provenance attestation
• [ ] TBD

[maxgio92]

Hey @oliverbaehler, can this issue be considered completed? Thanks!

[prometherion]

I'd say so, let's wait for Oliver's feedback.

[oliverbaehler]

Implemented, except SBOM for charts