sign Grype container image via cosign

[developer-guy]

What would you like to be added:

A tool called cosign¹ created and maintained by the sigstore ² community allows you to sign and verify container images. IINM Grype takes its releases via GoReleaser, luckily cosign is now integrated into GoReleaser.³. Btw, there is a similar topic ongoing for the ossf/scorecard project too.⁴

Why is this needed:

Additional context:

cc: @luhring @wagoodman

Footnotes

1. https://github.com/sigstore/cosign ↩

2. https://sigstore.dev/ ↩

3. https://carlosbecker.com/posts/goreleaser-cosign/ ↩

4. https://github.com/ossf/scorecard/issues/309 ↩

[luhring]

Let's focus discussion on the related Syft issue, and then reflect those conclusions back here 👍