feat: publish signed image provenance manifests

[msarahan]

Posted by Codex (GPT-5.6) on behalf of Michael Sarahan. Treat this description as LLM-generated.

Summary

Add a signed, OCI-referrer RAPIDS image provenance manifest for published base
and notebooks image digests.

• Export exact conda-meta package facts through minimal BuildKit targets rather
  than downloading image layers.
• Attach a platform-specific manifest to every pushed architecture image, then
  attach a multiarch index manifest that links those platform records.
• Record the image digest, platform, source SHA, workflow URL, build arguments,
  and conda package name/version/build/channel/source URL.
• Keylessly sign each attached OCI artifact with GitHub Actions OIDC and Cosign.
• Keep pURLs explicitly unmapped until a verified upstream mapping is available;
  this intentionally does not invent pkg:conda/... identifiers.

Relationship to #805

#805 is complementary. It generates and
embeds a CycloneDX SBOM in the final image. This change makes digest-bound build
facts discoverable as registry metadata and supplies the platform-to-multiarch
relationship needed by scan triage without pulling image layers.

If #805 lands, the preferred follow-up is to add its SBOM digest/reference to
this manifest rather than maintain a separate provenance model. Its Dockerfile
stage renaming will require a small conflict resolution in this branch's
provenance-base and provenance-notebooks export targets.

Validation

• pytest -q tests/test_image_provenance_manifest.py
• pre-commit run --all-files (Ruff, ShellCheck, Zizmor, copyright checks)
• YAML parsing and git diff --check

Buildx static validation was attempted but the local configured remote builder
timed out while connecting. No image was built locally. The first CI run should
therefore confirm Docker Hub OCI-referrer support and keyless Cosign signing on
the production runners.

[msarahan]

Posted by Codex (GPT-5.6) on behalf of Michael Sarahan. Treat this description as LLM-generated.

Provenance validation evidence

Validated the published OCI provenance artifacts from the current PR commit d606bf2 against Docker Hub, not only from workflow step status.

• Platform build job 89386657243 completed successfully for CUDA 12.9.1, Python 3.13, linux/arm64.
• The base image rapidsai/staging:docker-896-26.08a-cuda12-py3.13-arm64@sha256:c2b4... has an OCI referrer of type application/vnd.rapids.image.provenance.v1+json (sha256:9efb...).
• A standard oras pull of that artifact succeeds and retrieves image-provenance.json without a path-validation override. This confirms the safe layer-title fix, rather than merely showing that attachment succeeded.
• The pulled payload is schema v1 and records the immutable image digest and linux/arm64 platform, 407 exact conda package records (name, version, build, build number, channel, URL), relevant build args, source commit, and workflow URL. Package pURLs remain intentionally unmapped; the manifest does not invent pkg:conda identifiers.
• The platform job created a keyless Cosign/Rekor entry for the attached provenance artifact.
• The corresponding multiarch job 89388680477 also completed successfully. Its application/vnd.rapids.image.provenance.index.v1+json referrer pulls normally and links the multiarch subject to its exact amd64 and arm64 platform image digests.

This validates the intended chain: immutable image digest -> signed OCI provenance artifact -> exact package inventory, with a signed multiarch index relating the platform manifests.

[msarahan]

@jameslamb please take a (forgiving) look here. This would be a very useful thing as the release approaches. It would make it easier to triage container-based CVEs. If something here is wrong, please call it out. If it's not quite technically accurate, by all means call it out, but let practicality win over purity for now and let's sort out the rest in later work.

[msarahan]

I don't understand why the CI status above is showing all failure/cancellation. The current job is https://github.com/rapidsai/docker/actions/runs/30063835782, which is in considerably better shape. fixed