Document 'SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY'

[lukehinds]

A few users are being tripped up on this subject env not being documented. There should be an entry in docs.sigstore.dev

[hectorj2f]

+1

[asraa]

This option should not be exposed at all -- this trusts the public key by querying Rekor, which provides no protection. Users need to use the other options for setting a custom Rekor key outside of TUF

Actually, it should be removed. I'm waiting on scaffolding changes to go through (they are staged right now!)

[asraa]

This PR was actually incorrect: #2040

I'll put out a fix right now and add documentation on the correct way to set a custom non-TUF Rekor key.

[hectorj2f]

@asraa That PR was the result of this discussion #1997 (comment). Based on @haydentherapper comment, I assumed that was a well-known usage.

this trusts the public key by querying Rekor, which provides no protection

Why are we exposing the public key in rekor API if that could lead to security issues ?

[asraa]

@asraa That PR was the result of this discussion #1997 (comment). Based on @haydentherapper comment, I assumed that was a well-known usage.

I think there was just a mistake in the env var that the comment had.

See this earlier comment: #1997 (comment)

[asraa]

@haydentherapper

[hectorj2f]

👍🏻 , I saw it now in #2124

[asraa]

Why are we exposing the public key in rekor API if that could lead to security issues ?

Some services do not expose that for this reason. But it is convenient to double check what the public key is AGAINST an out of band delivered one.

[lukehinds]

closing, thanks @asraa