There are a lot of community images but not "official" ones. It would need a maintainer who uses the image and is willing to support others using it. Could be basically any community member, though.
The keys for ASUS, Surface, and Framework base images (Kinoite and Silverblue). I wrote a test for Bazzites CI to verify the sigs before building the image
Thank you! I was brainstorming over this yesterday after looking over a lot of the images Chainguard has and going through their documentation. Then this morning I put two and two together
Thought: Can't we create a few GitHub Actions such as sign-image and verify-image, and use them across all repos? That way there will be no signing logic in each repo, and they are all controlled in main or similar
Since all images use the same signing keys, the custom action could have the main/cosign.pub location hard-coded
then the maintenance on the repos would go from "copy and pasting improvements" to just dependabot bumping the version for us. That would be a huge win for long term maintenance and sustainability
I am still wondering how we can verify the third-party images before using them though... They are set in the Dockerfile as COPY --from=<image>COPY --from=<image>, so would we need to keep an up-to-date list of external images in the GHA workflow, or is there some integration we can do during builds?