Load a TrustRoot reference when using the policy-tester

[hectorj2f]

Summary

closes #560

Load a trustroot definition using the policy-tester.

policy-tester \
        --trustroot=trustroot.yaml \
        --policy=test/testdata/policy-controller/tester/cip-public-keyless.yaml \
        --image=k8s.gcr.io/pause:3.9

where the trustroot could be:

apiVersion: policy.sigstore.dev/v1alpha1
kind: TrustRoot
metadata:
  name: my-sigstore-keys
spec:
  sigstoreKeys:
    certificateAuthorities: []
    timestampAuthorities:
    - subject:
        organization: tsa-organization
        commonName: tsa-common-name
      uri: TSA_URL
      certChain: |-
        TSA_CERT_CHAIN
        ...

Release Note

Documentation

[codecov]

Codecov Report

Merging #698 (95e21f5) into main (00988ae) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #698   +/-   ##
=======================================
  Coverage   55.37%   55.37%           
=======================================
  Files          45       45           
  Lines        4791     4791           
=======================================
  Hits         2653     2653           
  Misses       1934     1934           
  Partials      204      204           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[priyawadhwa]

would it be possible to add a test in for verifying a TSA-signed image with a CIP and TrustRoot?

[hectorj2f]

@priyawadhwa We already have e2e tests to exercise this behauvior in the controller https://github.com/sigstore/policy-controller/blob/main/test/e2e_test_cluster_image_policy_with_tsa.sh#L136 and https://github.com/sigstore/policy-controller/blob/main/test/e2e_test_cluster_image_policy_with_tsa.sh#L129.