Use ValidatePubKey from sigstore/sigstore

[haydentherapper]

This improves RSA, ECDSA, and ED25519 (no-op) validation for imported keys.

Signed-off-by: Hayden Blauzvern hblauzvern@google.com

Summary

Ticket Link

Fixes

Release Note

Improved validation for imported RSA keys

[codecov-commenter]

Codecov Report

Merging #1676 (0b28ef1) into main (ac682db) will decrease coverage by 0.14%.
The diff coverage is 28.57%.

@@            Coverage Diff             @@
##             main    #1676      +/-   ##
==========================================
- Coverage   29.37%   29.22%   -0.15%     
==========================================
  Files         141      141              
  Lines        8429     8413      -16     
==========================================
- Hits         2476     2459      -17     
  Misses       5684     5684              
- Partials      269      270       +1     

Impacted Files	Coverage Δ
pkg/cosign/keys.go	61.36% <28.57%> (-4.86%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ac682db...0b28ef1. Read the comment docs.

[haydentherapper]

Hm, looks like we might have an issue due to Windows - golang/go#1108

[dlorenc]

Hm, looks like we might have an issue due to Windows - golang/go#1108

This is hitting a few things now... cc @cpanato any ideas what we should do here?

[cpanato]

Hm, looks like we might have an issue due to Windows - golang/go#1108

This is hitting a few things now... cc @cpanato any ideas what we should do here?

maybe we can use that https://github.com/hashicorp/go-syslog but then we will need to patch upstream

[cpanato]

did a change in a fork https://github.com/cpanato/boulder/commits/go-syslog and updated our side and push this change to a branch on my cosign fork and run CI here: cpanato#175

seems to compile and tests passed :)

I can submit this patch to boulder and then if they approve/merge we can update, in meantime we can use the replace directive, I guess

UPDATE: made a PR letsencrypt/boulder#6021

[dlorenc]

Thanks! Let's do the fork for now:)

[haydentherapper]

Thanks @cpanato for the fix! Added a replace directive to the fork.

[haydentherapper]

Looks to be building successfully on Windows, just an intermittent KinD E2E error now.

[haydentherapper]

@cpanato Looks like there's another suggestion to remove the logging statement from a core package in boulder

[cpanato]

based on the feedback from the letsencrypt maintainer I did a follow-up letsencrypt/boulder#6029 and did the testing on our side here #1676 which compile and tests passed

cross compile https://github.com/cpanato/cosign/runs/5768177620?check_suite_focus=true

[znewman01]

LGTM modulo testing/build/CI issues, which you all seem to have under control now :)

[haydentherapper]

Thanks @cpanato! I’ll wait til end of day to see if they approve and merge the change, otherwise I’ll use your fork.

[dlorenc]

Looks like we need codegen still, but Windows is passing!

[haydentherapper]

All tests are now passing, and the replace directive has been removed. PR is ready to go.