Leverage Rekor's Verifiers API to extract keys/certs from entries

[haydentherapper]

Description

We've created a Verifiers API in the Entries interface to abstract extracting "verifiers" - eg certificates, public keys, pgp keys, etc - from a given entry. This would simplify the logic in PublicKey() and add support for additional types (though there may be more places where types are hardcoded).

Interface: https://github.com/sigstore/rekor/blob/main/pkg/types/entries.go#L40

Code:

sigstore-go/pkg/tlog/entry.go

Lines 197 to 222 in f7518a6

	func (entry *Entry) PublicKey() any {
	var pemString []byte
	switch e := entry.rekorEntry.(type) {
	case *dsse_v001.V001Entry:
	pemString = []byte(*e.DSSEObj.Signatures[0].Verifier)
	case *hashedrekord_v001.V001Entry:
	pemString = []byte(e.HashedRekordObj.Signature.PublicKey.Content)
	case *intoto_v002.V002Entry:
	pemString = []byte(*e.IntotoObj.Content.Envelope.Signatures[0].PublicKey)
	}
	certBlock, _ := pem.Decode(pemString)
	var pk any
	var err error
	pk, err = x509.ParseCertificate(certBlock.Bytes)
	if err != nil {
	pk, err = x509.ParsePKIXPublicKey(certBlock.Bytes)
	if err != nil {
	return nil
	}
	}
	return pk

[vishal-chdhry]

Can you please also mention the additional types we have to add support here. As we will also have to add validation checks for those types like we do for the currently supported types

sigstore-go/pkg/tlog/entry.go

Lines 148 to 170 in 3a6a109

	func ValidateEntry(entry *Entry) error {
	switch e := entry.rekorEntry.(type) {
	case *dsse_v001.V001Entry:
	err := e.DSSEObj.Validate(strfmt.Default)
	if err != nil {
	return err
	}
	case *hashedrekord_v001.V001Entry:
	err := e.HashedRekordObj.Validate(strfmt.Default)
	if err != nil {
	return err
	}
	case *intoto_v002.V002Entry:
	err := e.IntotoObj.Validate(strfmt.Default)
	if err != nil {
	return err
	}
	default:
	return fmt.Errorf("unsupported entry type: %T", e)
	}
	return nil
	}

[haydentherapper]

That's a good point, I would say that this issue is blocked until Rekor adds a method on the Entries interface for both Validate() and Signature() (also needed here).

I'll leave this issue open for now, but consider it blocked.