fix: remove signing certificate output

[asraa]

Signed-off-by: Asra Ali asraa@google.com

Fixes #156

Updates README.md with the new output.

[laurentsimon]

lots of really interesting error messages in the log. One I had not seen before: Getting rekor entry error error searching rekor entries: [POST /api/v1/log/entries/retrieve][400] searchLogQueryBadRequest &{Code:400 Message:invalid public key: failure decoding PEM}, trying Redis search index to find entries by subject digest ... maybe that's one that'ex expected given the unit tests actually.

May be useful to separate the list of message by a comma. I created #161 to improve the logging we have and make it more structured / standard.

[asraa]

Oh, the error messages were from #159, not this PR.

error messages were added with a separated comma: https://github.com/asraa/slsa-verifier/blob/0c6f7c68bde9fd305579e11f86e40a79019e2451/pkg/rekor.go#L394

Maybe a newline? I"ll do that in the follow-up, not this PR

[asraa]

One I had not seen before: Getting rekor entry error error searching rekor entries: [POST /api/v1/log/entries/retrieve][400] searchLogQueryBadRequest &{Code:400 Message:invalid public key: failure decoding PEM}, trying Redis search index to find entries by subject digest ... maybe that's one that'ex expected given the unit tests actually.

I saw this one too, and I realize it's likely because there was no certificate PEM in the intoto envelope for the older builder tests. So rekor fails to decode the empty string PEM. Just added an error condition to prevent Rekor query if the cert is empty, so that'll be a clearer error message.

[laurentsimon]

Ready to merge?

[asraa]

Yes!