verify-blob: add URI to verify-blob output

[shibumi]

Summary

Adds an URI field to the verify-blob output.

Before this PR:

❯ COSIGN_EXPERIMENTAL=1  cosign verify-blob /tmp/mnemonic-0.3.1.tar.gz --signature /tmp/mnemonic-0.3.1.tar.gz.sig
Certificate is trusted by Fulcio Root CA
Email: []
Verified OK
tlog entry verified with uuid: "228527476f82c59641e27b8fb9b32f5fadbe47cf42c544ea97dc798490c4c14e" index: 853327

After this PR:

❯ COSIGN_EXPERIMENTAL=1  ./cosign verify-blob /tmp/mnemonic-0.3.1.tar.gz --signature /tmp/mnemonic-0.3.1.tar.gz.sig
Certificate is trusted by Fulcio Root CA
Email: []
URI: https://github.com/shibumi/mnemonic/.github/workflows/goreleaser.yml@refs/tags/v0.3.1
Issuer:  https://token.actions.githubusercontent.com
Verified OK
tlog entry verified with uuid: "228527476f82c59641e27b8fb9b32f5fadbe47cf42c544ea97dc798490c4c14e" index: 853327

Ticket Link

Fixes #1046

Release Note

verify-blob gained functionality for printing the URIs of the certificate if there are any.

[shibumi]

@dlorenc do you know how I get this information here?

            1.3.6.1.4.1.57264.1.1:
                https://token.actions.githubusercontent.com

Is it encoded as ASN1 struct in one of the other certificate fields?

[shibumi]

This part works for printing the certificate extension:

		for _, ext := range cert.Extensions {
			oidc := asn1.ObjectIdentifier{1,3,6,1,4,1,57264,1,1}
			if ext.Id.Equal(oidc) {
				fmt.Fprintln(os.Stderr, "1.3.6.1.4.1.57264.1.1: ", string(ext.Value))
			}
		}

But I have no idea if we might encounter more of these and if the certificate extension is always the same.
We might want to put that ObjectIdentifier as constant somewhere else.

[shibumi]

I am not really convinced yet if printing the x509 extension/object identifier value is a good idea.
I assume that the current object identifier (the hard coded one) is only valid for Github, is this correct?

And throwing all values to the user might be more confusing than it actually helps.

If the object identifier stays the same, it makes sense to include it. If not, we might just use the URIs?!

[shibumi]

Further investigation later. Looks like this OID stays the same:

[shibumi]

New Output:

Certificate is trusted by Fulcio Root CA
Email: []
URI: https://github.com/shibumi/mnemonic/.github/workflows/goreleaser.yml@refs/tags/v0.3.1
Issuer:  https://token.actions.githubusercontent.com
Verified OK
tlog entry verified with uuid: "228527476f82c59641e27b8fb9b32f5fadbe47cf42c544ea97dc798490c4c14e" index: 853327

[shibumi]

@dlorenc Would it make sense to give verify operations a format flag for machine-readable output? Or is this over the top?

[dlorenc]

Would it make sense to give verify operations a format flag for machine-readable output? Or is this over the top?

I think this makes sense, just a plain json output?

[shibumi]

Yes, just a plain json output, but I think it makes sense to address this in another issue.

If we implement a format flag, we have to stay persistent with the JSON schema. People would rely on it, because it is machine readable.

I will create a separate issue for this.

[shibumi]

Done: Separate Issue for JSON output: #1048