Verify any of several identities via CLI

[hugovk]

Description

Right now, an artifact that has been signed by one of several people can be verified via library use something like:

from sigstore.models import Bundle
from sigstore.verify import Verifier, policy

# Accept a signature from any one of several trusted identities.
# Each identity is pinned to the OIDC issuer it authenticates with.
TRUSTED_IDENTITIES = policy.AnyOf([
    policy.Identity(identity="alice@example.com", issuer="https://accounts.google.com"),
    policy.Identity(identity="bob@example.com", issuer="https://github.com/login/oauth"),
])

verifier = Verifier.production()
with open(filename, "rb") as f:
    verifier.verify_artifact(f.read(), Bundle.from_json(bundle_json),
TRUSTED_IDENTITIES)

But it's only possible to verify against a single identity via CLI:

sigstore verify identity \
    --cert-identity alice@example.com \
    --cert-oidc-issuer https://accounts.google.com \
    artifact.tgz

It would be useful to be able to verify against one of several via CLI as well.

[hugovk]

I don't have a strong opinion on how the CLI interface should look, but here's some ideas.

1. Repeatable paired flags

sigstore verify identity \
    --cert-identity alice@example.com --cert-oidc-issuer https://accounts.google.com \
    --cert-identity bob@example.com   --cert-oidc-issuer https://github.com/login/oauth \
    artifact.tgz

If all identities share the same issuer, perhaps allow to give it just once:

sigstore verify identity \
    --cert-identity alice@example.com \
    --cert-identity bob@example.com \
    --cert-oidc-issuer https://accounts.google.com \
    artifact.tgz

2. Combined flags

Use some sort of separator between identify and issuer:

sigstore verify identity \
    --any-identity 'alice@example.com=https://accounts.google.com' \
    --any-identity 'bob@example.com=https://github.com/login/oauth' \
    artifact.tgz

3. Add a --policy FILE pointing to a config file

Example TOML:

# comment 1
[[any-of]]
identity = "alice@example.com"
issuer = "https://accounts.google.com"
  
# comment 2
[[any-of]]
identity = "bob@example.com"
issuer = "https://github.com/login/oauth"

Which is the same as:

any-of = [
    { identity = "alice@example.com", issuer = "https://accounts.google.com" },  # comment 1
    { identity = "bob@example.com", issuer = "https://github.com/login/oauth" }, # comment 2
  ]

[woodruffw]

Thanks @hugovk!

Yeah, all things being equal I think I'm leaning towards some kind of policy file input, since (in principle) someone might have complex Boolean relations that would be difficult for us to express ergonomically with the CLI.