Add support for sigstoreSigned in (podman image trust set)

NOTE: This does not edit the use-sigstore-attachments value
in registries.d, similarly to how (podman image trust set) didn't
set the lookaside paths for simple signing.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/pkg/trust/policy.go b/pkg/trust/policy.go
index 77e02a05c..3a31b9338 100644
--- a/pkg/trust/policy.go
+++ b/pkg/trust/policy.go
@@ -161,6 +161,14 @@ func AddPolicyEntries(policyPath string, input AddPolicyEntriesInput) error {
 			newReposContent = append(newReposContent, RepoContent{Type: trustType, KeyType: "GPGKeys", KeyPath: filepath})
 		}
 
+	case "sigstoreSigned":
+		if len(pubkeysfile) == 0 {
+			return errors.New("at least one public key must be defined for type 'sigstoreSigned'")
+		}
+		for _, filepath := range pubkeysfile {
+			newReposContent = append(newReposContent, RepoContent{Type: trustType, KeyPath: filepath})
+		}
+
 	default:
 		return fmt.Errorf("unknown trust type %q", input.Type)
 	}