jobs/release: sign OCI images

This uses the new `cosa sign --oci` switch to sign our OCI images using
the official Fedora GPG keys.

Part of coreos/fedora-coreos-tracker#1969.

I opted for not gating this behind a knob. It's safe to do this even on
streams that still use encapsulated commits (it's just files in S3). But
the earlier we do it, the more overlap we have in which both signature
types (OCI and OSTree) co-exist and that makes migration planning
easier.

Author: jlebon

jobs/release.Jenkinsfile

@@ -289,13 +289,28 @@ lock(resource: "release-${params.STREAM}", extra: locks) {
                                 --auth=tmp/push-secret-${metajsonname} \
                                 --repo=${repo.repo} ${tag_args.join(' ')} \
                                 --artifact=${artifact} --metajsonname=${metajsonname} \
-                                --build=${params.VERSION} ${v2s2_arg}
+                                --build=${params.VERSION} ${v2s2_arg} \
+                                --write-digest-to-file=tmp/${metajsonname}-digest
                             rm tmp/push-secret-${metajsonname}
                             """)
                         }
                     }
                 }]}
             }
+            stage("Sign OS Container") {
+                pipeutils.tryWithMessagingCredentials() {
+                    pipeutils.shwrapWithAWSBuildUploadCredentials("""
+                    manifest_list_digest=\$(cat tmp/base-oscontainer-digest)
+                    cosa sign --build=${newBuildID} \
+                        robosignatory --s3-sigstore ${s3_stream_dir}/sigs/oci \
+                        --aws-config-file \${AWS_BUILD_UPLOAD_CONFIG} \
+                        --extra-fedmsg-keys stream=${params.STREAM} \
+                        --oci --gpgkeypath /etc/pki/rpm-gpg \
+                        --fedmsg-conf=\${FEDORA_MESSAGING_CONF} \
+                        --manifest-list-digest=\${manifest_list_digest}
+                    """)
+                }
+            }
         }
 
         if (uploading_to_brew) {