verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for using a key from rekor's API

[asraa]

Signed-off-by: Asra Ali [email protected]

Scaffolding no longer requires it.

If user's still depend on this, they can use hte SIGSTORE_REKOR_PUBLIC_KEY and directly curl the rekor API

Related #2122

Summary

Release Note

* fix!: Breaking change. This removes the insecure environment variable `SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY` that is used to fetch the public key from the API of the configured Rekor URL. Use `SIGSTORE_REKOR_PUBLIC_KEY` to configure a custom rekor public key.
* fix!: Breaking change: `GetRekorPubs` no longer requires a rekor client. Rekor public keys are no longer fetched from the Rekor API directly when `SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY` is enabled.

Documentation

[asraa]

As a follow-up I'd still like to move the RekorPublicKeys to part of Sign/Verification options like Fulcio Roots are. This is generally tough, I always got stuck, but we'll see. That way GetRekorPubs is not called internally in the sign/verify flows and users can configure it.

[codecov-commenter]

Codecov Report

Merging #2362 (b45a4f3) into main (32f6f1a) will increase coverage by 0.04%.
The diff coverage is 77.77%.

@@            Coverage Diff             @@
##             main    #2362      +/-   ##
==========================================
+ Coverage   30.19%   30.24%   +0.04%     
==========================================
  Files         136      136              
  Lines        8432     8416      -16     
==========================================
- Hits         2546     2545       -1     
+ Misses       5555     5541      -14     
+ Partials      331      330       -1     

Impacted Files	Coverage Δ
pkg/cosign/env/env.go	88.88% <ø> (ø)
pkg/cosign/tlog.go	40.06% <50.00%> (+1.62%)	⬆️
cmd/cosign/cli/verify/verify_blob.go	46.41% <100.00%> (ø)
pkg/cosign/verify.go	34.13% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[haydentherapper]

Yay!

[asraa]

I think the CI failure was flakey: but rebased and crossing my fingers!

[asraa]

If we make a v2 branch I'll remove the unused param there. Merging for now.