Add bundle output to rekor-cli

[davidcorrigan714]

Essentially I'm trying to stand up a current implementation of what's detailed in sigstore/cosign#3457 (comment) where we have a centralized signing HSM that we'd like to sign our images with, without downloading the whole container to the signing infrastructure machines. In a nutshell it seems like I can sign the digest payload data from cosign generate $IMAGE_DIGEST > payload.json, upload it to rekor, but at this point I can't get the modern bundle format out of rekor-cli to feed into cosign attach signature --signature ... . Seems like this idea aligns with some of the discussion on sigstore/cosign#4477 for how the attach command can work . So, am I on the right track with thinking it reasonable to add the latest bundle output format to rekor-cli for that use case? I think I'll have time to put up a PR for that in the next few weeks if it sounds like a reasonable approach.

[Hayden-IO]

Providing --format=tle when calling rekor-cli get should return the Rekor entry in the format that's expected for the bundle. However you'll still need to compose the signature and the Rekor entry proof together - for that, we'll need sigstore/cosign#3794 (which we are planning to add shortly).

I will mention that we are rolling out https://github.com/sigstore/rekor-tiles, a v2 of Rekor, and don't plan to accept new features in this codebase. We hadn't planned to have a separate CLI for uploading and fetching proofs from Rekor v2, but the use case you describe might be a reason we should. Feel free to file an issue there requesting a CLI for your use case.

[davidcorrigan714]

Interesting, I’m afk for the next week or so and will have to read up on those when I get back. Figured out as much as I could the past 3 days but still wrapping my head around all the various payloads and signature structures. I got like 80% of the way with constructing the tlog entry in the bundle then threw the whole codebase and my notes at Claude and told it to fix my mess, managed to fix my scripts and got the whole thing verify properly with the latest version of cosign. It’s all bash now so isn’t pretty just trying to prove out workflows still. We also may just call the Go libraries directly, gotta hash out our exact strategy there with folks still. Also trying to figure out if we can reuse the same certs we use for things like driver signing, the teams that manage our HSMs would really appreciate not needing more keys to manage - looks like the —trusted-root argument should do that with our Digicert certs but hadn’t done a proof of concept.