Description

Currently we have some support for signing with x509 certificates using haven't come from a Fulcio CA and and don't chain up to a TUF root. For example

cosign sign --certificate cert.pem --key key.pem --certificate-chain bundle.pem example.com/foo@sha256:.....

Aside: the key format needs to be cosign's format to make this work so you often need to run e.g cosign import-key-pair to make that the case

The current invocation to verify this kind of signature is a little inconvenient as you need to specify the leaf certificate like so:

cosign verify --certificate cert.pem --certificate-chain bundle.pem example.com/foo@sha256:....

This means grabbing that leaf certificate off the OCI manifest or from the Rekor bundle or something. Would be great to be able to do the same kind of invocation as Fulcio's verification like

cosign verify --certificate-chain bundle.pem --certificate-identity foo@example.com --certificate-oidc-issuer https://id.example.com example.com/foo@sha256:.....

This convenient keyless verification would be awesome for folks using a custom CA, provided they're using certificates in a similar shape that Fulcio does (Efforts to standardize these extensions like sigstore/fulcio#945 would make it easy for folks to create a CA that does this)