chore: Add install tutorial with cosign check.

Signed-off-by: Matthias Glastra <matglas.git@gmail.com>

.goreleaser.yaml

@@ -23,9 +23,12 @@ source:
   enabled: true
 signs:
   - cmd: cosign
+    certificate: '${artifact}.pem'
+    signature: '${artifact}.sig'
     args:
       - "sign-blob"
       - "--output-signature=${signature}"
+      - '--output-certificate=${certificate}'
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
     artifacts: all

INSTALL.md

@@ -0,0 +1,39 @@
+# Install Witness manually and verify
+
+> [!NOTE]
+> Please use release v0.7.0 or higher, as prior releases were created to
+> test the release workflow.
+
+This repository provides pre-built binaries that are signed and published using
+[GoReleaser]. The signature for these binaries are generated using [Sigstore],
+using the release workflow's identity. Make sure you have [cosign] installed on
+your system, then you will be able to securely download and verify the gittuf
+release:
+
+## Unix-like operating systems
+
+```sh
+# Modify these values as necessary.
+# One of: amd64, arm64
+ARCH=amd64
+# One of: linux, darwin, freebsd
+OS=linux
+# See https://github.com/in-toto/witness/releases for the latest version
+VERSION=0.6.0
+cd $(mktemp -d)
+
+curl -LO https://github.com/in-toto/witness/releases/download/v${VERSION}/witness_${VERSION}_${OS}_${ARCH}
+curl -LO https://github.com/in-toto/witness/releases/download/v${VERSION}/witness_${VERSION}_${OS}_${ARCH}.sig
+curl -LO https://github.com/in-toto/witness/releases/download/v${VERSION}/witness_${VERSION}_${OS}_${ARCH}.pem
+
+cosign verify-blob \
+    --certificate witness_${VERSION}_${OS}_${ARCH}.pem \
+    --signature witness_${VERSION}_${OS}_${ARCH}.sig \
+    --certificate-identity https://github.com/in-toto/witness/.github/workflows/release.yml@refs/tags/v${VERSION} \
+    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+    witness_${VERSION}_${OS}_${ARCH}
+
+sudo install witness_${VERSION}_${OS}_${ARCH} /usr/local/bin/witness
+cd -
+witness version
+```

README.md

@@ -49,6 +49,8 @@ latest release:
 bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh)
 ```
 
+If you want install it manually and verify its integrity follow the instructions in the [INSTALL.md](./INSTALL.md).
+
 ### Tutorials
 Check out our Tutorials: