Add Chainguard OIDC provider.

[mattmoor]

Summary

This adds support for Chainguard issued tokens, so that users can sign with their Chainguard-issued identity, and so that we can explore signing our own content with our internal service principal construct (see issue).

Related: #1702

Release Note

Add support for signing with Chainguard-issued tokens.

Documentation

This is mostly intended for our own use, but I'd be happy to document how folks can make use of this with chainctl auth token --audience sigstore if someone points me in the right direction.

[haydentherapper]

Is this a provider you would want enabled in the public instance as well? If so, do you have an estimated QPS we should expect?

[mattmoor]

Is this a provider you would want enabled in the public instance as well? If so, do you have an estimated QPS we should expect?

Yes. No real estimation, but I would expect that if anything this would cannibalize QPS we are currently sending with github actions tokens. I could work with someone on the rotation to try and figure out what that might look like, if it's important.

[mattmoor]

Rebased on @cpanato go change

[mattmoor]

... and fixed merge conflict that drops CompactSerialize() method.

[codecov]

Codecov Report

Attention: Patch coverage is 78.94737% with 8 lines in your changes missing coverage. Please review.

Project coverage is 48.79%. Comparing base (cf238ac) to head (d87bb86).
Report is 126 commits behind head on main.

Files	Patch %	Lines
pkg/identity/chainguard/principal.go	77.77%	3 Missing and 3 partials ⚠️
pkg/identity/chainguard/issuer.go	71.42%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1703      +/-   ##
==========================================
- Coverage   57.93%   48.79%   -9.14%     
==========================================
  Files          50       69      +19     
  Lines        3119     4082     +963     
==========================================
+ Hits         1807     1992     +185     
- Misses       1154     1869     +715     
- Partials      158      221      +63     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[haydentherapper]

LGTM - Do you want to hold off until you've added the custom OIDs, or merge this as is?

[mattmoor]

I'd say we land this as-is and we can make additive changes as the need for enriching things under our own OID arises. 👍

[cpanato]

late lgtm

[mattmoor]

Let me know if there are instructions to test against staging (and when I can expect that to work!) 🙏

[haydentherapper]

I queued up the change in staging, I'll update here once it's rolled out. https://docs.sigstore.dev/system_config/public_deployment/#usage has instructions on how to test.

[mattmoor]

@haydentherapper this seems out of date:

curl -O https://raw.githubusercontent.com/sigstore/root-signing/main/staging/repository/1.root.json

I poked around in the repo, and I don't see an obvious replacement for the staging root.

[haydentherapper]

sigstore/docs#315 for the doc fix