Integrate sigstore's root of trust into cosign

[dekkagaijin]

Allows for us to validate cert chains and signatures for arbitrary images and binaries.

TODO: decide on what the UX should look like for keyless attestation of signatures

[dlorenc]

cc @asraa any thoughts here?

[asraa]

Hm! Interesting good point. Here's what you could do:

With the client portion of the demo code #366:
We can fetch and validate the targets the root of trust signed (e.g. fulcio root ca and rekor public key hardcoded in cosign) before using them. Where would we want to place them the TUF metadata though?

• on a registry like the demo PR?
• we could fetch directly with HTTP on GitHub as well

In order to facilitate all of that people would need to provide / trust some initial root keys they trust (to bootstrap all of this anyway). That needs a source of truth/provision as well.

Edit: But besides facilitating the client to fetching the targets with the initial root, I don't think anything else in the UX needs to change

[asraa]

We can fetch and validate the targets the root of trust signed (e.g. fulcio root ca and rekor public key hardcoded in cosign) before using them.

If it makes sense to pin the initial root in cosign and add verification for Fulcio/Rekor keys and certs, let me know! I can at least use an HTTP fetch.

[dlorenc]

Don't know how I closed this one by accident!

@dekkagaijin could you link your doc here when it's ready?