[Feature] Sign Docker images

Description

To prevent Supply Chain Attacks, the graph-node Docker image should be signed. It's a simple and one-time setup. I've seen you use GCP ecosystem to build and push to Docker Hub. Simply follow the documentation to setup.

More information can be found at the Sigstore documentation.

A whole walk through sigstore and it's cluster policy controller is described in this blog post.

Are you aware of any blockers that must be resolved before implementing this feature? If so, which? Link to any relevant GitHub issues.

No response

Some information to help us out

• Tick this box if you plan on implementing this feature yourself.
• I have searched the issue tracker to make sure this issue is not a duplicate.

Commencez par localiser le workflow basé sur GCP qui construit et pousse l’image Docker de graph-node vers Docker Hub. Lisez la documentation liée de Binary Authorization et de Sigstore afin de déterminer la configuration de la signature ainsi que les identifiants requis ou l’intégration à la policy. C’est terminé lorsque l’image publiée est signée et que sa signature peut être vérifiée.