fix: use keys for signing + mock examples (#158)

.github/workflows/builder.yml

@@ -89,18 +89,11 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request'
         run: |
-          cosign sign -y ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
         env:
           TAGS: ${{ steps.push.outputs.digest }}
-          COSIGN_EXPERIMENTAL: 1
+          COSIGN_EXPERIMENTAL: false
-
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-      - name: Verify the pushed tags
-        if: github.event_name != 'pull_request'
-        run: |
-          cosign verify ${{ steps.registry_case.outputs.lowercase}}/${{ env.IMAGE_NAME }}@${TAGS} --certificate-identity-regexp "https://github.com/${{ github.repository }}" --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
-        env:
-          TAGS: ${{ steps.push.outputs.digest }}
-          COSIGN_EXPERIMENTAL: 1
 
       - name: Echo outputs
         run: |

README.md

@@ -10,6 +10,15 @@ It mounts `mock/` on the current directory so that you can get the resulting RPM
 ```bash
 # You can specify whatever chroot you want to use, usually those that are supported on COPR should work
 just build $PATH_TO_SPEC $ARGUMENTS_FOR_MOCK
+
+# This builds devpod on the Fedora version that the builder container is on (F41)
+just build ./staging/devpod/devpod.spec
+
+# This builds devpod on the CentOS Stream + EPEL 10 chroot
+just build ./staging/devpod/devpod.spec -r epel-10-$(arch)
+
+# You can also compile for other architectures by passing --forcearch if you have qemu-user-static on your host system
+just build ./staging/devpod/devpod.spec --forcearch=aarch64
 ```
 
 The COPR hosting our packages can be found [here].

cosign.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHLRpBfPRYiMl9wb7s6fx47PzzNWu
+3zyJgXhWEvxoOgwv9CpwjbvUwR9qHxNMWkJhuGE6cjDA2hpy1I6NbA+24Q==
+-----END PUBLIC KEY-----