feat(sign): split HOW_TO_VERIFY.txt into an offline integrity check and an online signature check

[leechienpang]

What type of PR is this?

/kind feature

What this PR does / why we need it

<release>_HOW_TO_VERIFY.txt (make howtoverify, #186) mixed a check that needs nothing but sha256sum with checks that need cosign and, for a keyless signature, the network. Customers at sites without Internet access couldn't tell which parts they could run there. The instructions now come in two labelled parts:

• A. Integrity (offline): sha256sum -c --ignore-missing <release>_SHA256SUMS. The files are exactly the ones in the release's signed list. It needs no network and no cosign, and catches a corrupted, incomplete or altered download.

• B. Signature and SBOM attestations (online):

  • B1: cosign verify-blob on the list.
  • B2: cosign verify-blob-attestation for each image.

  cosign fetches Sigstore's trust data on its first run. For a key signature made without the transparency log (test builds), the heading reads "offline with this key".

The file also says that A alone doesn't show the list is genuine; B does. B needs only the small files (the list and the .sigstore.json bundles), not the images. So an air-gapped site runs A on site and B on any connected machine.

	Before	After
Order	1. signature, 2. contents, 3. attestations	A. contents (offline), then B1. signature, B2. attestations (online)
Network needs	one line ("the first run needs network access") for all of it	stated per part; A needs none
Air-gapped sites	not covered	"run A there and B on any machine that has Internet access"

Which issue(s) this PR fixes

Part of bigstack-oss/cubecos-private#219

Special notes for your reviewer

Note

Verified locally: test_projsign.sh, 68/68. It checks:

• the contents check sits under "A. Integrity (offline)" and A mentions no cosign;
• the three cosign commands sit under B;
• B reads "offline with this key" for the key-without-log stand-in, and "online" for the keyless rendering, with the reason;
• every command still runs from the file and passes in the signed stand-in ship directory.

8 checks fail against the previous layout.

The offline/online split matches what was measured on cubecos-private#220: sha256sum -c has no network use; keyless verify-blob without a trusted root fails at once with no network ("tuf refresh failed").

Not verified: a real publish producing the new file. The next signed publish will, through triangle#181.

Additional documentation

Cubecos: bigstack-oss/cubecos#1811. Handbook: bigstack-oss/bigstack-handbook#950 updates release-how-to-verify-file.md to the A/B parts.

<release>_HOW_TO_VERIFY.txt now separates the two checks:
  A. Integrity (offline): sha256sum -c against the signed list of digests. Needs no network.
  B. Signature and SBOM attestations (online): cosign verify-blob / verify-blob-attestation.
     Needs network access on cosign's first run, but only the small .sigstore.json and
     list files, not the images.
At a site without Internet access, run A there and B on any connected machine.

🤖 Generated with Claude Code