[feature]Add COSIGN_REPOSITORY input for the generator_container_slsa3 workflow

[saisatishkarra]

Is your feature request related to a problem? Please describe.
Cosign allows publishing attestations and provenance to a repository other than the image repository using the environment variable COSIGN_REPOSITORY.

• This will be helpful in scenarios where a single digest/container image is tagged with multiple repositories and would help publish provenance to an external repository to avoid pollution in all image repositories for the same digest.
• Reduces migration effort of tags when moving signatures / provenance attestations for multiple images with same digest
• Helps to provide a single point of repository to external customers during verification of multiple images of same digest

Describe the solution you'd like
COSIGN_REPOSITORY must be allowed as an input and set as env variable for cosign command
When set, use this repository to publish provenance instead of image repository.
When unset/empty, publish provenances as per the parsed image repository (default cosign behavior)

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

[laurentsimon]

Thanks. I think we'll need to also have an option in the verifier tool https://github.com/slsa-framework/slsa-verifier, correct?

Someone can make it work by setting the COSIGN_REPOSITORY when calling the slsa-verifier, but it's probably cleaner to have a dedicated option like slsa-verifier --attestation-store?

[ianlewis]

Docs seem to be here: https://docs.sigstore.dev/system_config/registry_support/#specifying-registry

I don't see any info about authentication in the docs.

[saisatishkarra]

@laurentsimon / @ianlewis Let me know if i can help raise a PR in the verifier and what direction needs to be taken. In the meantime can this be merged to support the workflow if the slsa-verifier supports COSIGN_REPOSITORY and later be made compatible with the CLI option?

[ianlewis]

@saisatishkarra I think we can add the necessary options here and then add them to the verifier later. I think we just need to make sure we get the implementation right. See our comments on the PR.

[laurentsimon]

Yes, please add the necessary options in the PR you already opened. We can help you for slsa-verifier after that. I think the main question we have on the PR is for authentication to the separate registry.

[saisatishkarra]

@laurentsimon / @ianlewis I have added the Authentication to a separate provenance registry if specified to the existing PR. Please review and help guide the changes needed for the slsa-verifier (client)

[laurentsimon]

Completed in #2962