initial setup

[jku]

This is a meta bug for getting the repository setup and running tuf-on-ci

• Fix permissions root-signing-staging maintainer permissions not working community#356
• setup workflows, configure publishing: setup tuf-on-ci workflows #2
• implement token support in tuf-on-ci support explicit GH tokens theupdateframework/tuf-on-ci#128
• setup online signing Setup online signing #8
• setup TUF_ON_CI token Setup a Sigstore bot token  #18
• copy current staging metadata/artifacts to this project copy the current staging metadata/artifacts to this project #9
• fix google cloud auth fails during online-sign #20
• initial (import) signing event sign/import: Import current staging metadata #6
• fix online signing "cloudkms.cryptoKeyVersions.useToSign" fails with 403 #22
• maybe publish to GCS Publish to staging GCS #7
• tweak repository configuration if needed
  • at least define our own PR template that make it clear PRs should be opened from signing events, except when updating README or workflows: the default sigstore template is a bit useless Write better PR templates  #5

[jku]

It turns out we're also blocked by theupdateframework/tuf-on-ci#128 as I believe the org does not allow GITHUB_TOKEN with the permissions we need

[jku]

It turns out we're also blocked by theupdateframework/tuf-on-ci#128 as I believe the org does not allow GITHUB_TOKEN with the permissions we need

Update on this: I was tied in other things for last week but have been implementing this now. It's still ongoing but I should have a PR for this early next.

[jku]

Status update on the blockers:

• tuf-on-ci PR is in review now Support custom GitHub tokens theupdateframework/tuf-on-ci#147, hoping to merge this week
• the online key setup is progressing but not ready yet

[jku]

Status update on the blockers:

• Custom token support is merged
• the online key setup is WIP

[jku]

status update:

• online key projects/projectsigstore-staging/locations/global/keyRings/tuf-keyring/cryptoKeys/tuf-staging-key/cryptoKeyVersions/1 is ready
• Setup a Sigstore bot token  #18 is now done

plan for tomorrow (cc @kommendorkapten):

• merge workflows: Upgrade to tuf-on-ci 0.4 Release Candidate #19
• merge Prepare metadata import #10
• solve google cloud auth fails during online-sign #20
• Have initial signing event to get things operational
• Another signing event (not necessarily on same day) to add more signers

[jku]

status update:

• signing event done
• current blocker online signing "cloudkms.cryptoKeyVersions.useToSign" fails with 403 #22

[jku]

• Online signing works
• repository is a compatible upgrade from current official staging repository
• repository has been tested with cosign and sigstore-python

I'll do one more small thing and will then call this done:

• upgrade the workflows to use v0.4.0 for tuf-on-ci actions