Use trust config everywhere

[jku]

Use ClientTrustConfig throughout the project. This makes it so that everything required to sign or verify using a specific Sigstore instance comes from a single config file: No hard coded URLs should now be used (except in some historical edge cases like fix-bundle).

Apologies for the seemingly large PR. The PR is actually net removal of code and fairly small (165 insertions(+), 180 deletions(-)) but there's a lot of asset updates: This is done to get test coverage for signingconfig handling (new root-signing-staging has a signingconfig 0.2 so I wanted to update the assets in testing and felt I should update _store/ as well at that point).

Fixes #1347, fixes #1371, fixes #1359

• Use TrustConfig.signing_config to get the OIDC url
• Provide the from_tuf() method for TrustConfig and not just Trustedroot: this matches the CLI where we chose to support --trust-config
• Use ClientTrustConfig as the initialization source where that makes sense (OIDC, SigningContext)
• There is a special case in ClientTrustConfig for Public Good production: prod does not have signingconfig yet so we hard code one for now
• Refactor embedded asset lookup: directories are now based on repository URLs so there's less hard coded if-clauses for Public Good instance. This means we could now add a --tuf-url argument (to choose something that is not production or staging public good instance ), but I did not add it yet
• Update the embedded staging assets and the testing staging assets: This means the staging signing config is used to test the code in unit tests. Doing this requires mocking datetime.now() since the current staging metadata actually expires, unlike the very old metadata that was used here before

[jku]

I want to review the API a bit: Maybe the internal components (like SigningContext) don't actually have to know about ClientTrustConfig and could just get a SigningConfig and/or TrustedRoot instead...

It looks a bit messy but I think it's fine:

• Verifier takes a TrustedRoot as argument: this makes some sense since it only needs the trust root
• SigningContext takes a complete ClientTrustConfig since it at least currently requires data from both signing config and trust root
• Issuer now just takes a url as argument (calling SigningConfig.get_oidc_url() is simple enough, no need to have a special constructor)

[jku]

CC @ramonpetgrave64

[jku]

ah, I forgot that if I update the staging test assets I need to handle the TUF timestamp expiring... I think that's just a minor monkeypatch (or at worst I need to generate a new tuf repo) but it does mean this is not yet ready for review

[jku]

sigh, now the tests are failing because timestamp-authority is doing a release and our tests are expecting it to be available already because the tags are there...

I will continue on monday

[jku]

I've marked this ready for review. It's a big patch but only 200 lines are code changes (rest is assets). I can try to split this but it might not make it easier to manage.

[jku]

I should update make target update-embedded-root since I'm changing _store directory names

EDIT: fixed

[woodruffw]

I don't love that we now have URL-encoded filenames checked into the project, but I don't have a great alternative here. Maybe we could trim the https:// prefix, although that could be a waste of time?

[jku]

yeah, it's not great.

I think I'll leave the https there (we don't currently test with a local http server but if someone ever wants to, assuming https would be a blocker). Not a strong opinion though, can do that change anyone really doesn't like it.

[woodruffw]

LGTM, thanks @jku!

I left one non-blocking comment about the URL-encoded filenames, but we can merge if you don't want to bother with that.

[jku]

Thank you 🙏