Merge 11ff9f0f46 into 83be5fb151

The `build-push-image.yml` reusable workflow can generate keypairs and
sign the container images with them.

This is only used by the CI, to test that a valid signature is actually
detected as such.

.github/workflows/build-push-image.yml

@@ -54,7 +54,6 @@ jobs:
       debian_archive_date: ${{ steps.params.outputs.debian_archive_date }}
       source_date_epoch: ${{ steps.params.outputs.source_date_epoch }}
       image: ${{ steps.params.outputs.full_image_name }}
-      tag: ${{ steps.params.outputs.tag }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -285,4 +284,4 @@ jobs:
           enableCrossOsArchive: true
       - name: Sign container
         run: |-
-          cosign sign --key ${{ inputs.key_name }}.key ${{ inputs.registry }}/${{ inputs.image_name }}:${{ needs.merge.outputs.tag }}@${{ needs.merge.outputs.digest_root }}
+          cosign sign --key dangerzone-test.key ${{ inputs.registry }}/${{ inputs.registry_user }}/${{ inputs.image_name }}:${{ needs.merge.outputs.tag }}@sha256:${{ needs.merge.outputs.digest_root }}