feat(CLDX-82): add checksum signing step

[swickersh]

This commit adds a step to the sign-binaries task to generate the sha256 sums of all the signed binaries and collect them in a single file (sha256sum.txt).
It then transfers the file to a remote host to be signed with Red Hat's GPG key. The detached signatures are returned and released alongside binaries in subsequent tasks to the RH Developer Portal.

[openshift-ci]

Hi @swickersh. Thanks for your PR.

I'm waiting for a konflux-ci member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[swickersh]

@mmalina @johnbieren,

When @pkhander returns from PTO next week we'll get #566 rebased.
After that he and I will run the entire push-binaries pipeline several times. We plan to submit (hopefully) one last PR at that point with any fixes we encounter. Prior to that, no products will be using this pipeline.
Thanks!

[johnbieren]

So do you want this merged in the meantime?

[swickersh]

So do you want this merged in the meantime?

Yes, I don't see any reason to not go ahead and get it reviewed/merged.

[johnbieren]

/ok-to-test