sigstore: extract LogEntry conversions to their own functions

[facutuesca]

This moves the logic that converts between rekor_v1.TransparencyLogEntry and sigstore.models.LogEntry to their own separate functions:

    @classmethod
    def _from_dict_rekor(cls, dict_: dict[str, Any]) -> LogEntry:
    ...

    def _to_dict_rekor(self, is_message_signature: bool) -> dict[str, Any]:
    ...

The motivation for having these available is PEP 740, which defines an attestation format for PyPI artifacts. This PEP doesn't define a specific transparency log entry format, rather it leaves the choice to the implementation. In practice, it makes sense to use the exact same structure as a rekor_v1.TransparencyLogEntry for these entries. Using a different structure is not necessary and would introduce another format conversion to keep track of.

This means that at some point, in order to verify artifacts using the PEP 740 attestation format, we will have to convert it (back) to a Sigstore bundle. The only API to construct a Bundle other than Bundle.from_json is Bundle.from_parts:

    def from_parts(cls, cert: Certificate, sig: bytes, log_entry: LogEntry) -> Bundle:

But since it requires an already constructed LogEntry, it can't be used unless you already have one.

The new methods would allow a user of sigstore-python to create a LogEntry from an existing rekor_v1.TransparencyLogEntry without exposing the actual type, just a dict[str, Any]. This would look something like:

def pypi_to_sigstore(pypi_attestation: Attestation) -> Bundle:
    ....
    tlog_entry = pypi_attestation.verification_material.transparency_entries[0]

    return Bundle.from_parts(..., log_entry = LogEntry._from_dict_rekor(pypi_attestation....))

cc @woodruffw

[woodruffw]

Thanks @facutuesca! Could you add a round-trip test for these? Something simple where we ensure that entry == from_dict(to_dict(entry)) works would be perfect 🙂

[woodruffw]

(Test failures are OK; expected as part of ongoing flakiness from staging.)

[facutuesca]

Thanks @facutuesca! Could you add a round-trip test for these? Something simple where we ensure that entry == from_dict(to_dict(entry)) works would be perfect 🙂

done!

[woodruffw]

LGTM, thanks @facutuesca!