Add ability for verify-blob to find signing cert in transparency log

[DennisDenuto]

Summary

When a user has opted into keyless mode, and they have signed a blob, allow a user to verify a blob without having to specify a certificate.

questions / concerns:

• Currently, the first certificate found in the tlog (for the blob) is used when verifying. However, this might not be the correct cert to use when verifying. I'm not sure what the best ux around this should be. Perhaps a new flag should be introduced to help narrow down which cert is used to verify the blob. (Allow the user to specify a subject / email address?) or perhaps cosign should loop through all the certificates it finds and attempt to verify the blob + sig against each one (this has performance implications)
• where is a good place to add tests?

Ticket Link

Aims to improve #676 (comment)

Release Notes

When a user has opted into keyless mode, and they have signed a blob, allow a user to verify a blob without having to specify a certificate.

[naveensrinivasan]

Summary

When a user has opted into keyless mode, and they have signed a blob, allow a user to verify a blob without having to specify a certificate.

questions / concerns:

• Currently, the first certificate found in the tlog (for the blob) is used when verifying. However, this might not be the correct cert to use when verifying. I'm not sure what the best ux around this should be. Perhaps a new flag should be introduced to help narrow down which cert is used to verify the blob. (Allow the user to specify a subject / email address?) or perhaps cosign should loop through all the certificates it finds and attempt to verify the blob + sig against each one (this has performance implications)
• where is a good place to add tests?

Ticket Link

Aims to improve #676 (comment)

Release Notes

When a user has opted into keyless mode, and they have signed a blob, allow a user to verify a blob without having to specify a certificate.

We were looking for the same. Thanks

[dlorenc]

This is awesome! Thanks so much!

[naveensrinivasan]

@DennisDenuto The cosign still looks for a cert Error: verifying blob [go.mod]: exactly one of: key reference (--key), certificate (--cert) or hardware token (--sk) must be provided. I pulled down the head and tried to verify this.

[DennisDenuto]

@naveensrinivasan hmm did you set the experimental flag on? i.e COSIGN_EXPERIMENTAL=1