Think about signing the built container images about build-and-push-action HOT 3 OPEN

The signature can be created with GitHub Action and then stored in the container registry.
Quay already supports the sigstore, as it is based on OCI, however only from version 3.6 and quay.io yet wasn't upgraded to this version (but will be).
When the quay.io supports the sigstore we could sign our containers, and ship them signed.
The authentication of the signer is done via the OpenID connect

from build-and-push-action.

@vrothberg is working on a project with signing containers. We can be a pioneers :) https://github.com/sigstore/cosign

from build-and-push-action.

Thanks for the ping. Yes, we are working on integrating sigstore/cosign support into the container tools (Skopeo, Podman, Buildah).

from build-and-push-action.