feat(verification): automatically verify on describe command

[jiparis]

This PR adds automatic verification on workflow run describe command, using the trusted root from Chainloop service and verification material from the attestation.
Note that only the signature and certificate chain are validated. Certificate contents validation is not yet implemented (issuer, SAN, etc.)

> chainloop wf run describe --digest sha256:0c432b7de0dde8c1aea926086e9346980c03abecd3461e00bb87413f50466037
┌───────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Workflow                                                                                              │
├─────────────────────────────┬─────────────────────────────────────────────────────────────────────────┤
│ ID                          │ 95f1b597-20e1-498c-b931-fc6d7331860e                                    │
│ Name                        │ mywf                                                                    │
│ Team                        │                                                                         │
│ Project                     │ myproject                                                               │
│ Version                     │ v0.162.0 (prerelease)                                                   │
├─────────────────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Workflow Run                │                                                                         │
├─────────────────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ ID                          │ 5fed99ee-c48e-475e-ab9d-2954c1f9b495                                    │
│ Initialized At              │ 12 Feb 25 09:18 UTC                                                     │
│ Finished At                 │ 12 Feb 25 09:19 UTC                                                     │
│ State                       │ success                                                                 │
│ Runner Link                 │                                                                         │
├─────────────────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Statement                   │                                                                         │
├─────────────────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Payload Type                │ application/vnd.in-toto+json                                            │
│ Digest                      │ sha256:0c432b7de0dde8c1aea926086e9346980c03abecd3461e00bb87413f50466037 │
│ Verified                    │ true                                                                    │
│ Policies violation strategy │ ADVISORY                                                                │
│ Policies                    │ ------                                                                  │
│                             │ source-commit: Ok                                                       │
│                             │ sbom-present: missing SBOM material                                     │
└─────────────────────────────┴─────────────────────────────────────────────────────────────────────────┘
INF you can use the flag "--output statement" to see the full in-toto statement

[migmartri]

Simple and nice.

So if there is a bundle but generated with asymetric keys, the verification error will be swallowed and verify will be still false correct?

[jiparis]

Simple and nice.

So if there is a bundle but generated with asymetric keys, the verification error will be swallowed and verify will be still false correct?

Correct. In that case it will detect missing Verification material, and will fallback to prevous behaviour (you'd need --verify true --key cosign.pub to do the verification)

[javirln]

Love this!