usage: release.sh --registry <host[:port]> --channel <name> --version vX.Y.Z \
--sign-key <cosign.key> [options]
required
--registry channel registry host[:port]
--channel channel name, e.g. acme-stable
--version kit version to publish, vX.Y.Z (semver, 'v' prefix required)
--sign-key cosign private key; the pushed digest is signed with it
options
--source kit tree to package (default: this script's directory)
--out where to write the tarball (default: a temp dir)
--no-latest do not move the 'latest' channel tag to this version
--insecure registry TLS is self-signed (test rigs)
--plain-http registry is plain HTTP (test rigs)
--dry-run package and print the push, push nothing