feat: Support signing bundles during copy

cmd/porter/copy.go

@@ -37,6 +37,7 @@ If the source bundle is a digest reference, destination must be a tagged referen
 	cmd.Flag("force").Annotations = map[string][]string{
 		"viper-key": {"force-overwrite"},
 	}
+	f.BoolVar(&opts.SignBundle, "sign-bundle", false, "Sign the bundle using the configured signing plugin")
 
 	return &cmd
 }

docs/content/docs/references/cli/bundles_copy.md

@@ -35,6 +35,7 @@ porter bundles copy [flags]
       --force                Force push the bundle to overwrite the previously published bundle
   -h, --help                 help for copy
       --insecure-registry    Don't require TLS for registries
+      --sign-bundle          Sign the bundle using the configured signing plugin
       --source string         The fully qualified source bundle, including tag or digest.
 ```
 

docs/content/docs/references/cli/copy.md

@@ -35,6 +35,7 @@ porter copy [flags]
       --force                Force push the bundle to overwrite the previously published bundle
   -h, --help                 help for copy
       --insecure-registry    Don't require TLS for registries
+      --sign-bundle          Sign the bundle using the configured signing plugin
       --source string         The fully qualified source bundle, including tag or digest.
 ```
 

pkg/porter/copy.go

@@ -19,6 +19,7 @@ type CopyOpts struct {
 	Destination      string
 	InsecureRegistry bool
 	Force            bool
+	SignBundle       bool
 }
 
 // Validate performs validation logic on the options specified for a bundle copy
@@ -98,9 +99,27 @@ func (p *Porter) CopyBundle(ctx context.Context, opts *CopyOpts) error {
 
 	bunRef.Reference = destinationRef
 
-	_, err = p.Registry.PushBundle(ctx, bunRef, regOpts)
+	bunRef, err = p.Registry.PushBundle(ctx, bunRef, regOpts)
 	if err != nil {
 		return span.Error(fmt.Errorf("unable to copy bundle to new location: %w", err))
 	}
+
+	if opts.SignBundle {
+		for _, invImage := range bunRef.Definition.InvocationImages {
+			relocInvImage := bunRef.RelocationMap[invImage.Image]
+			span.Debugf("signing invocation image %s...", relocInvImage)
+			err = p.Signer.Sign(ctx, relocInvImage)
+			if err != nil {
+				return span.Errorf("failed to sign image %s: %w", relocInvImage, err)
+			}
+		}
+
+		span.Debugf("signing bundle %s", bunRef.Reference.String())
+		err = p.Signer.Sign(ctx, bunRef.Reference.String())
+		if err != nil {
+			return span.Errorf("failed to bundle %s: %w", bunRef.Reference.String(), err)
+		}
+	}
+
 	return nil
 }