[tonistiigi]

depends on #6298

I'll probably move the helper utilities to a separate helper repository as they don't need to be buildkit specific. That would also contain the sigstore parts for image verification that we would need to share with moby.

[crazy-max]

Was wondering if it would not be easier to have static keys/conf mounted instead of generating them like: https://github.com/crazy-max/ghaction-import-gpg/tree/master/__tests__/fixtures

[tonistiigi]

The key generation is small step of this. The main part is that we need to import these keys into the gpg keychain state in $BUILDKIT_TEST_SIGN_FIXTURES/.gpghome and then create gitconfig with signing wrappers for each user. If we do that anyway, then we would just need to replace the generation command with a command that imports a static private key (pre-prepared for a specific user) to the keychain(probably getting flagged by security scanners for committing private keys to git). So it is really simpler to just generate a new one each time we build the test-integration environment.

[crazy-max]

Some users have GPG signing-only subkeys and seems go-crypto armor package handles it. Don't think we need extra test for this as we are just doing verification, just fyi.

[crazy-max]

I'll probably move the helper utilities to a separate helper repository as they don't need to be buildkit specific. That would also contain the sigstore parts for image verification that we would need to share with moby.

Yes agreed