Conformance: sigstore-python's conformance runner should support `--trusted-root`

[woodruffw]

See sigstore/sigstore-conformance#101.

[woodruffw]

Partial dupe of #779, closing that one in favor of this.

[jku]

From #779:

This will unify the current rats nest of flags for configuring custom Sigstore behavior: we'll be able to deprecate and eventually remove --rekor-url, --rekor-root-pubkey, --fulcio-url, --ctfe, and possibly some others. This in turn will allow us to close #324.

This sounds good:

• allow specifying --trusted-root <FILE> so TUF can be skipped without making a mess of the UI
• figure out rekor url and fulcio url from trusted root contents instead of hard coding (if the urls are not in there, they should be added)
• deprecate flags mentioned above to make it clear a complete trusted root should be provided instead (there might be some exceptions to this but I think that's a good general rule)

All of these can happen in separate issues/PRs

[woodruffw]

• deprecate flags mentioned above to make it clear a complete trusted root should be provided instead (there might be some exceptions to this but I think that's a good general rule)

Yeah, I think we can get all of them with this -- we could deprecate with 2.1.x and plan to fully remove with 3.x, which would make me very happy 🙂

[jku]

Some notes after a bit of thinking:

• We have essentially three cases (only first one is implemented today)
  • default: trustroot comes from TUF
  • offline: trustroot comes from TUF target cache
  • trustroot comes from user via --trusted-root
• Current TrustedRoot class handles two separate things: the TUF client operations and easy access to trustroot contents
  • We should separate them as the TUF operations are only needed in the default case above but the latter is needed in all three cases

[woodruffw]

• We should separate them as the TUF operations are only needed in the default case above but the latter is needed in all three cases

Makes sense to me!

[jku]

I'll take this. Plan is:

• Move all of the parsing and sanity checking into a class derived from sigstore_protobuf_specs TrustedRoot
• this class has multiple constructors:

  def from_file(path: str) -> MyTrustedRoot:
  def from_tuf(url: str, offline: bool = False) -> MyTrustedRoot:
  def production(offline: bool = False) -> MyTrustedRoot: # helper, calls from_tuf()
  def staging(offline: bool = False) -> MyTrustedRoot: # helper, calls from_tuf()
  

• from_tuf() (and the helpers production() and staging()) will use TrustUpdater by default but from_file() (and the others if offline) will just get trust root from a file
• the tuf module will now only be used from this new class
• adding UX for --trusted-root should be fairly trivial but I'll probably leave the offline UX support for a later PR if that looks complicated