docs: Add comment for signature decoding (#380)

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* Update verifiers/internal/gcb/provenance.go

Co-authored-by: asraa <asraa@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: asraa <asraa@google.com>

verifiers/internal/gcb/provenance.go

@@ -412,13 +412,19 @@ func (self *Provenance) VerifyVersionedTag(tag string) error {
 
 func decodeSignature(s string) ([]byte, []error) {
 	var errs []error
+	// First try the std decoding.
 	rsig, err := base64.StdEncoding.DecodeString(s)
 	if err == nil {
 		// No error, return the value.
 		return rsig, nil
 	}
 	errs = append(errs, err)
 
+	// If std decoding failed, try URL decoding.
+	// We try both because we encountered decoding failures
+	// during our tests. The DSSE documentation does not prescribe
+	// which encoding to use: `Either standard or URL-safe encoding is allowed`.
+	// https://github.com/secure-systems-lab/dsse/blob/27ce241dec575998dee8967c3c76d4edd5d6ee73/envelope.md#standard-json-envelope.
 	rsig, err = base64.URLEncoding.DecodeString(s)
 	if err == nil {
 		// No error, return the value.