feat: judge, sign and verify netOrk's images in one place (NetOrk/netork#1390)

The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived
in NetOrk/base-os, the head of the chain. Every link below it -- base-python,
engine, ui, satellite, the service images -- needs the same, so the tools
move here, and every image repository pins them by commit.

- image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The
  image's own repository holds its cis.toml and packages.allow; both default
  to the working directory.
- bin/sign.sh signs whatever platforms a reference holds: base-os's index of
  amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest
  (image_tools/platforms.py).
- bin/verify-base.sh checks every FROM image of a Dockerfile against
  cosign.pub before a build; one without a digest is refused
  (image_tools/dockerfile.py).
- bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners,
  checked against the release checksums.
- actions/verify-base, judge, sign wrap them for the workflows.
- cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret,
  the key rotated on 2026-10-22.

README.md

@@ -0,0 +1,77 @@
+# image-tools
+
+Judges, signs and verifies the container images of [netOrk](https://git.netork.io/NetOrk/netork).
+Every image repository of NetOrk uses these tools at a pinned commit, so the same rules apply
+to every link of the chain:
+
+```
+netork/base-os ──► netork/base-python ──► netork/engine, netork/satellite
+               └─► netork/ui
+               └─► postgres, valkey, signal-api, apt-cacher-ng, unbound
+```
+
+Each link checks the signature of the image it builds on, is judged against CIS, and is signed
+with its CIS result and SBOM attached (NetOrk/netork#1390).
+
+## What it does
+
+| | |
+|---|---|
+| **CIS gate** (`image_tools/cis.py`) | CIS Docker Benchmark 1.6.0 §4 and the CIS Debian Linux 12 controls that make sense in a container. Trivy measures what it automates; `image_tools/cis_os.sh` measures from inside the image. The image's repository decides the rest in its `cis.toml` and names the packages it may hold in `packages.allow`. |
+| **SBOM** (`image_tools/sbom.py`) | The image's CycloneDX SBOM, as Trivy reads it. |
+| **Signature** (`bin/sign.sh`) | A cosign signature on the reference and on every platform image behind it, with the CIS result and the SBOM as in-toto attestations. Nothing goes to a public transparency log. |
+| **Verification** (`bin/verify-base.sh`, `bin/verify-signature.sh`) | Every `FROM` image of a Dockerfile is pinned by digest and signed with the key in `cosign.pub`. |
+| **Verdict** (`image_tools/verify.py`) | Whether a rebuild improves on the pinned image, by netOrk's matcher (kb-server), for a base's nightly. |
+
+## Using it in a workflow
+
+```yaml
+- name: Verify the base images
+  uses: https://git.netork.io/NetOrk/image-tools/actions/verify-base@<commit>
+  with:
+    dockerfiles: docker/engine/Dockerfile
+
+# build the image, then:
+- name: Judge it
+  uses: https://git.netork.io/NetOrk/image-tools/actions/judge@<commit>
+  with:
+    image: registry.netork.io/netork/engine:main-abc1234
+    arch: amd64
+
+# push it, then:
+- name: Sign it
+  uses: https://git.netork.io/NetOrk/image-tools/actions/sign@<commit>
+  env:
+    COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+    COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+  with:
+    ref: registry.netork.io/netork/engine@sha256:…
+```
+
+The judge action reads `cis.toml` and `packages.allow` from the working directory by default.
+The runner needs Docker, Python 3.11 or newer, and `curl`; cosign is installed by the actions,
+pinned and checked against its release checksum (`bin/install-cosign.sh`).
+
+## Verifying an image yourself
+
+```bash
+cosign verify --key cosign.pub --insecure-ignore-tlog registry.netork.io/netork/base-os@sha256:…
+cosign verify-attestation --key cosign.pub --insecure-ignore-tlog \
+  --type https://netork.io/attestations/cis/v1 registry.netork.io/netork/base-os@sha256:…
+```
+
+`cosign.pub` is the public half of the `COSIGN_PRIVATE_KEY_B64` organization secret. The private
+key comes base64 in one line: the runner masks a secret only where it appears whole.
+
+## Development
+
+```bash
+pip install pytest ruff pyyaml shellcheck-py
+pytest -q
+ruff format --check . && ruff check .
+shellcheck bin/*.sh image_tools/cis_os.sh
+```
+
+## License
+
+MIT, see [LICENSE](LICENSE).