When deducing the Rekor log key ID, cosign universally assumes a Rekor
v1 type checkpoint, which is not C2SP compliant. Rekor v2 is compliant
for all different types of keys, which means the log ID must be
calculated differently. This affects the `trusted-root create` tool
which must generate the log ID from the public key. This change adds the
ability for the trusted-root command to parse a ":" in the --rekor-key
flag to indicate that the trusted material should be generated for a
Rekor v2 log and that the origin string following the ":" should be used
to calculate it. This is backwards compatible and will not affect Rekor
v1 which needs no origin string.
This addresses the issue strictly for this command so that trusted_root
files can be created for Rekor v2 servers. A later change will make more
general changes to the TUF client to ensure the trusted material is
generated properly for the server it relates to.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
a7345fb2ce