feat: validates signatures against the images if they exist in the images spec

src/internal/packager/images/pull.go

@@ -49,6 +49,10 @@ func (i *ImageConfig) PullAll() ([]ImgInfo, error) {
 		imgInfoList       []ImgInfo
 	)
 
+	const (
+		CosignSignatureAnnotationKey = "dev.cosignproject.cosign/signature"
+	)
+
 	type digestInfo struct {
 		refInfo transform.Image
 		digest  string
@@ -103,6 +107,33 @@ func (i *ImageConfig) PullAll() ([]ImgInfo, error) {
 				return
 			}
 
+			cosignArtifactsExist := false
+			cosignArtifacts, err := utils.GetCosignArtifacts(actualSrc)
+			if err != nil {
+				metadataImageConcurrency.ErrorChan <- fmt.Errorf("failed to get cosign artifacts for %s: %w", actualSrc, err)
+				return
+			}
+
+			if len(cosignArtifacts) > 0 {
+				cosignArtifactsExist = true
+				message.Debugf("Found Cosign signature in image %s", actualSrc)
+				message.Debugf("Cosign artifacts: %v", cosignArtifacts)
+			} else {
+				message.Debugf("No Cosign signature found in image %s", actualSrc)
+			}
+
+			if cosignArtifactsExist {
+				for _, cosignArtifact := range cosignArtifacts {
+					if strings.HasSuffix(cosignArtifact, ".sig") {
+						err := utils.CosignVerifyBlob(actualSrc, cosignArtifact, "cosign.pub")
+						if err != nil {
+							metadataImageConcurrency.ErrorChan <- fmt.Errorf("failed to get verify image using cosign signature for %s: %w", actualSrc, err)
+							return
+						}
+					}
+				}
+			}
+
 			if metadataImageConcurrency.IsDone() {
 				return
 			}

src/test/e2e/cosign_validate_test.go

@@ -0,0 +1,20 @@
+package test
+
+import (
+	"github.com/stretchr/testify/require"
+	"path/filepath"
+	"testing"
+)
+
+func TestCosignImageValidation(t *testing.T) {
+	t.Log("E2E: Validate Cosign Image Signature if available")
+
+	e2e.SetupWithCluster(t)
+
+	createPath := filepath.Join("examples", "argocd")
+
+	// Destroy the cluster to test Zarf cleaning up after itselz[f
+	stdOut, stdErr, err := e2e.Zarf("package", "create", createPath, "--confirm", "--log-level=debug")
+	require.NoError(t, err, stdOut, stdErr)
+
+}