Merge pull request #820 from crazy-max/signing

sigstore class to sign and verify buildkit provenance blobs

.github/workflows/test.yml

@@ -146,6 +146,9 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJson(needs.prepare-itg.outputs.includes) }}
+    permissions:
+      contents: read
+      id-token: write # needed for signing with GitHub OIDC Token
     steps:
       -
         name: Checkout