generate cosign signature

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ name: Service CI
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 on:
   pull_request:
@@ -87,8 +88,73 @@ jobs:
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
+        id: build
         with:
           context: ${{ matrix.context }}
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.0
+        with:
+          cosign-release: 'v3.1.3'
+
+      - name: Check install
+        run: cosign version
+
+      - name: Setup Fianu
+        uses: fianulabs/actions@main
+        with:
+          version: 1.9.67
+
+      - name: Setup Fianu again
+        uses: fianulabs/actions@main
+        with:
+          version: 1.9.67
+
+#      - name: Initialize TUF
+#        env:
+#          FIANU_HOST: app.fianu.io
+#          FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
+#          FIANU_CLIENT_SECRET: ${{ secrets.FIANU_CLIENT_SECRET }}
+#        run: |-
+#          fianu root init
+#          curl -sSf "https://app.fianu.io/ledger/root/targets/trusted_root.json" -o trusted_root.json
+
+      - name: Initialize Cosign
+        run: |
+          cosign initialize \
+          --mirror "https://app.fianu.io/ledger/root" \
+          --root "https://app.fianu.io/ledger/root/root.json"
+
+      - name: Signing Config
+        run: |
+          cosign signing-config create \
+            --fulcio="url=https://app.fianu.io/ledger/fulcio,api-version=1,start-time=2020-01-01T00:00:00Z,operator=fianu" \
+            --rekor="url=https://rekor-tiles.prod.fianu.io,api-version=2,start-time=2020-01-01T00:00:00Z,operator=fianu" \
+            --rekor-config="ANY" \
+            --tsa="url=https://app.fianu.io/ledger/timestamp,api-version=1,start-time=2020-01-01T00:00:00Z,operator=fianu" \
+            --tsa-config="ANY" \
+            --output-file signing_config.json
+
+#      - name: Output Trusted Root
+#        run: cat trusted_root.json
+
+      - name: Output the Config
+        run: cat signing_config.json
+
+      - name: Sign Image
+        run: |
+          cosign sign \
+          -a commit=${{ github.sha }} \
+          --signing-config=signing_config.json \
+          --yes \
+          "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
+
+      - name: Verify Signature
+        run: |
+          cosign verify \
+          --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
+          --certificate-identity-regexp="^https://github\.com/Coveros/.*$" \
+          "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

services/auth-service/nodejs/README.md

@@ -1,3 +1,5 @@
 # Codeveros Auth Service Node.js
 
 Repository for Node.js-based Codeveros Auth Service
+
+CHANGE