Make sure a cert passed in via --cert matches the bundle cert

[priyawadhwa]

This is part of #2632, and is one of the smaller action items listed in #2632 (comment).

Signed-off-by: Priya Wadhwa priya@chainguard.dev

Release Note

Documentation

[codecov-commenter]

Codecov Report

Merging #2652 (3c0afc7) into main (35bf1fe) will decrease coverage by 0.01%.
The diff coverage is 40.00%.

@@            Coverage Diff             @@
##             main    #2652      +/-   ##
==========================================
- Coverage   30.01%   30.01%   -0.01%     
==========================================
  Files         146      146              
  Lines        9288     9296       +8     
==========================================
+ Hits         2788     2790       +2     
- Misses       6070     6074       +4     
- Partials      430      432       +2     

Impacted Files	Coverage Δ
cmd/cosign/cli/verify/verify_blob.go	48.91% <40.00%> (-0.43%)	⬇️
cmd/cosign/cli/verify/verify_blob_attestation.go	33.48% <40.00%> (-0.16%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[asraa]

This doesn't handle the OCI image case, right? Since in that case the bundle is on-disk and only gets read during the internal verification call.

[znewman01]

This doesn't handle the OCI image case, right? Since in that case the bundle is on-disk and only gets read during the internal verification call.

That's a good catch. I think long-run, we're going to want:

1. An inner verify method that doesn't know anything about the bundle
2. An outer verifyBundle method that takes in certificate, bundle, etc. and unpacks them into a verify call

Then, all of verify, verify-blob, verify-blob-attestation, etc. would go through verifyBundle; this check would happen in (2).

As it stands, I haven't been able to figure out whether this actually happens in verify (and if so, where). Given that users probably shouldn't be doing this anyway, I'm comfortable with just fixing it here.

[asraa]

As it stands, I haven't been able to figure out whether this actually happens in verify (and if so, where). Given that users probably shouldn't be doing this anyway, I'm comfortable with just fixing it here.

I think this was the source of the original issue though, right? From #2632 is an OCI image.

[znewman01]

I think #2633 is more important for that, this was just a side issue and I think it's more obviously a problem for verify-blob