The expected behavior is to fetch an existing entry from the log when
signing generates the same signature, so that signing is idempotent.
The bug was that the prepended shard ID was compared to the log ID. The
log ID is a sha256 hash of the log's public key, which is not the same
as the shard ID. Now we compare the prepended shard IDs from both the
request and response entry UUID when present.
This was not caught in tests since we used a valid shard ID as input
rather than the log ID.
Verified by generating an RSA key (which will generate the same
signature given the same input) and signing a container.
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
2a34b4ca94