fix(backport/1.0): make client shard aware when verifying entries on inactive shards

[asraa]

No description provided.

[ianlewis]

I realize it's not completely new, but I think it's a bit unfortunate that rekor clients like slsa-verifier need to have logic for sharding. It feels like clients are being exposed to too many implementation details and that's making things brittle.

[ianlewis]

A bunch of other tests seem to be generating this error. I'm not sure if that's intentional, but you may need to update other tests.

[asraa]

Figured it out! It turns out it was a problem in the UUID lengths returned that was hairy:
old entries (like the ones in these tests) were added when the UUID lengths of rekor were 64 chars. that was causing verification errors now when trying to extract tree IDs from full UUIDs (now 80 chars) in order to perform the verifyRootHash that broke when rotating shards.

Now I use the full 80 char UUID that was returned from GetLogEntryByUUID

[asraa]

I realize it's not completely new, but I think it's a bit unfortunate that rekor clients like slsa-verifier need to have logic for sharding. It feels like clients are being exposed to too many implementation details and that's making things brittle.

I completely agree: sharding was meant to be internal client, but it wasn't: things are getting better (the return UUID sharding comparisons eventually can be removed) but seem like they won't be stable until after GA. It's been a pain to deal with this logic and debug.

I should be able to clean up this logic when GA does give us a stable client though. For e.g. we will no longer need to fetch the root hash and search shards for the correct one: a root hash will be returned with the entry.

I'm hesitant to make some of these changes prematurely though, because rekor keeps rolling back versions :|

[ianlewis]

I should be able to clean up this logic when GA does give us a stable client though. For e.g. we will no longer need to fetch the root hash and search shards for the correct one: a root hash will be returned with the entry.

It's a bit unclear from the outside what is GA and what isn't with regard to Rekor and that translates to slsa-github-generator since we rely on the public Rekor.

I'm hesitant to make some of these changes prematurely though, because rekor keeps rolling back versions :|

Completely understandable. We need to work with what we have currently.