1db7f78724
Currently, when verifying a bundle with a short-lived certificate and a
Rekor v2 entry, users must specify --use-signed-timestamps and provide a
signed timestamp, because Rekor v2 entries do not contain integrated
timestamps unlike Rekor v1. This isn't a great UX.
This change opportunistically sets --use-signed-timestamps when we
detect that a user is verifying a short-lived certificate with a Rekor
v2 entry. We won't automatically set this with a mixed Rekor v1 and
Rekor v2 bundle (which the tooling will not produce, this would be for
any custom clients) or when verifying with a managed key.
Fixes #4500
(cherry picked from commit 71291bec3b)
Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
Co-authored-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>