ci/patch images

[R3DRUN3]

Reason for the Pull Request

Implementing a pipeline for automatic hardening, signing, and attestation of Fury images.

What it adds

A straightforward Python utility to compile a json file with the list of images requiring patching and a GitHub Action for patching.

Additional Notes

To function properly, the pipeline requires the following secrets to be configured within the repository:

• COSIGN_PASSWORD
• COSIGN_PRIVATE_KEY
• SIGHUP_REGISTRY_USERNAME
• SIGHUP_REGISTRY_PASSWORD

[R3DRUN3]

LGTM 😊

[ralgozino]

The PR code-wise looks good to me.

I don't have enough context to say if this is the right way to solve the problem though. I'd leave the final approve to @nutellinoit

[nutellinoit]

We are also syncing multi-arch images, for example https://github.com/sighupio/fury-distribution-container-image-sync/blob/main/modules/monitoring/images.yml#L256

How did you achieve that?

BTW, we need to fix a call to discuss this change

[R3DRUN3]

@nutellinoit

How did you achieve that?

Unfortunately, at the moment, Copa does not support out-of-the-box and seamless patching of multi-architecture images.
Please note that this patching mechanism is best effort; therefore, we cannot guarantee that all images will be patched. Some may not have known vulnerabilities, others may have a peculiar combination of OS and libraries, causing the Copa process to fail, etc.

BTW, we need to fix a call to discuss this change.

Yes, we definitely need to schedule a call as there are a few matters we need to discuss.
I have also noticed that, for some images, you are using the latest tag and not opting for lightweight images (e.g., those based on Alpine)...we need to address this point as well.

[R3DRUN3]

Warning

Given the recent amendments made to SSC, this PR might be deprecated.
I recommend aligning it with the SSC pipeline (excluding product-specific changes like the self-hosted runner steps, harbor path, email report, unit tests etc.).