root policy: add optional issuer to maintainer keys

[asraa]

Signed-off-by: Asra Ali asraa@google.com

Summary

• Adds an optional issuer to the trusted maintainer keys (e.g. we trust asraa@google.com with issuer https://accounts.google.com) now that the issuer is added to the Fulcio certificate. If a maintainer signs with a different issuer than one specified, then signing fails (test added). If no issuer is specified, then anything goes.

Ticket Link

Fixes

Release Note

Sample root policy:

{
	"signatures": [
		{
			"cert": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNuakNDQWlXZ0F3SUJBZ0lUZXZRcVc2NEFZb0ZqcE9Zc2l6eGxrenAzNHpBS0JnZ3Foa2pPUFFRREF6QXEKTVJVd0V3WURWUVFLRXd4emFXZHpkRzl5WlM1a1pYWXhFVEFQQmdOVkJBTVRDSE5wWjNOMGIzSmxNQjRYRFRJeApNVEV3TkRFNU1UVXlPVm9YRFRJeE1URXdOREU1TXpVeU9Gb3dBREJaTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5CkF3RUhBMElBQk1TZ0o3WGR0K00wcmgwa2VHTERZaWlCUjBiRWRQSXhYak1VcUR0T1RjMEJZd0RUa1ZCWlZPeW0KcSsvYW9YUjQ5L3Nud3dadnlSOVQzTjJMY1E2aXdJcWpnZ0ZTTUlJQlRqQU9CZ05WSFE4QkFmOEVCQU1DQjRBdwpFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd013REFZRFZSMFRBUUgvQkFJd0FEQWRCZ05WSFE0RUZnUVU0cUpJCjEza0w5V0NzbUI5MzRHV1lkNTZTQkpRd0h3WURWUjBqQkJnd0ZvQVV5TVVkQUVHYUpDa3lVU1RyRGE1SzdVb0cKMCt3d2dZMEdDQ3NHQVFVRkJ3RUJCSUdBTUg0d2ZBWUlLd1lCQlFVSE1BS0djR2gwZEhBNkx5OXdjbWwyWVhSbApZMkV0WTI5dWRHVnVkQzAyTURObVpUZGxOeTB3TURBd0xUSXlNamN0WW1ZM05TMW1OR1kxWlRnd1pESTVOVFF1CmMzUnZjbUZuWlM1bmIyOW5iR1ZoY0dsekxtTnZiUzlqWVRNMllURmxPVFl5TkRKaU9XWmpZakUwTmk5allTNWoKY25Rd0hnWURWUjBSQVFIL0JCUXdFb0VRWVhOeVlXRkFaMjl2WjJ4bExtTnZiVEFwQmdvckJnRUVBWU8vTUFFQgpCQnRvZEhSd2N6b3ZMMkZqWTI5MWJuUnpMbWR2YjJkc1pTNWpiMjB3Q2dZSUtvWkl6ajBFQXdNRFp3QXdaQUl3Ck1zNk1yT0xLRWRLWGlkbzFncXRDK21RemZHMUczeEkvU0lUN0dVOGJhbnlqUWZLckZLb2M1Yi9XbHo5L3krZWwKQWpBWlcvY0t5T3V4LzNCSWVlWHVDVGFSeCtLRklzVUY1eWZ5YlBONnByYmJyc2NTakt0OUJPdUl3SXhUYmdQYwppd2c9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
			"keyid": "e47b8d2a2b634135d827af23abe80312caf36ddfbee96f5da18839858065a68f",
			"sig": "MEQCICafyPTsxLy2KHlbcc2JD6X/1gqqQ4o9DFYoWMpTSY++AiA9s3zyPlrhurolv+x7dk0Fg9H8bkJ8S+03tB9Eetr9Jw=="
		}
	],
	"signed": {
		"_type": "root",
		"consistent_snapshot": true,
		"expires": "2022-02-04T20:15:10Z",
		"keys": {
			"0eda0dd31d8fe01ae3f53bba953c1695c84897177a68563401766be789293623": {
				"keyid_hash_algorithms": [
					"sha256",
					"sha512"
				],
				"keytype": "sigstore-oidc",
				"keyval": {
					"identity": "jpenumak@redhat.com",
					"issuer": "https://accounts.google.com"
				},
				"scheme": "https://fulcio.sigstore.dev"
			},
			"c1c74a408e5ed201fca76a2a70be4e8073c3e94632b28b5e35963d082e0c7aee": {
				"keyid_hash_algorithms": [
					"sha256",
					"sha512"
				],
				"keytype": "sigstore-oidc",
				"keyval": {
					"identity": "lsturman@redhat.com",
					"issuer": "https://accounts.google.com"
				},
				"scheme": "https://fulcio.sigstore.dev"
			},
			"e47b8d2a2b634135d827af23abe80312caf36ddfbee96f5da18839858065a68f": {
				"keyid_hash_algorithms": [
					"sha256",
					"sha512"
				],
				"keytype": "sigstore-oidc",
				"keyval": {
					"identity": "asraa@google.com",
					"issuer": "https://accounts.google.com"
				},
				"scheme": "https://fulcio.sigstore.dev"
			},
			"eb3630ade0d69ff50375c5e2d67dc2ad30d90183b6ea67538b1c86459a56d897": {
				"keyid_hash_algorithms": [
					"sha256",
					"sha512"
				],
				"keytype": "sigstore-oidc",
				"keyval": {
					"identity": "asra123ali@gmail.com",
					"issuer": "https://accounts.google.com"
				},
				"scheme": "https://fulcio.sigstore.dev"
			}
		},
		"namespace": "ghcr.io/asraa/sigstore-kubecon",
		"roles": {
			"root": {
				"keyids": [
					"c1c74a408e5ed201fca76a2a70be4e8073c3e94632b28b5e35963d082e0c7aee",
					"eb3630ade0d69ff50375c5e2d67dc2ad30d90183b6ea67538b1c86459a56d897",
					"e47b8d2a2b634135d827af23abe80312caf36ddfbee96f5da18839858065a68f",
					"0eda0dd31d8fe01ae3f53bba953c1695c84897177a68563401766be789293623"
				],
				"threshold": 2
			}
		},
		"spec_version": "1.0",
		"version": 1
	}
}

[asraa]

cc @lukehinds @jyotsna-penumaka @lkatalin

[lukehinds]

LGTM thanks Asra.