Plugin signing pipeline (cosign / Sigstore)

[tayebmokni]

Summary

Set up the plugin signing pipeline using cosign / Sigstore per doc 13 §7.2. Plugin .wasm modules are signed at publish time with the publisher's cosign identity (Sigstore keyless OIDC or KMS-backed). The host loads plugin.signing.trusted_keys (PEM bundle, identity regex/exact match) from the secret store. Unsigned plugins are blocked by default. Plugins from unknown publishers require admin confirmation (type publisher name) plus an audit-log event. Plugins whose signature does not verify are refused to load.

Design reference

• docs/13-security-baseline.md §7.2 (plugins signing), §7.9 (tradeoffs — keyless vs KMS)

Acceptance criteria

• Publish pipeline cosign sign step for plugin .wasm artifacts (Sigstore keyless via GitHub OIDC, or KMS-backed)
• Host plugin loader runs cosign verify against identities in plugin.signing.trusted_keys
• Signature verification failure → refuse to load with clear error
• Unknown publisher → admin UI hard warning with typed publisher-name confirmation
• Audit log event on unknown-publisher activation
• Documented trust bundle format and management procedure
• Integration test covers: signed-trusted-loaded, signed-unknown-needs-confirm, unsigned-refused, tampered-refused

Dependencies

#105

Complexity

L