In 32a2d62a the ability to use TUF to read and refresh trusted_root.json
was added. Prior, there was already a --trusted-root flag for verify*
commands, to read trusted_root.json directly without using a TUF client.
This did not exist for the sign* commands, which still need key material
to verifyi the CT key. The workaround for the sign commands was to use
the SIGSTORE_CT_LOG_PUBLIC_KEY_FILE environment variable, but when the
TUF client was updated, this workaround regressed. This change makes it
so that this flag will still work and that the machine's cached trusted
root is not used if it's not intended to be used. The permanent fix
going forward should be to add the --trusted-root flags to the sign*
commands.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
b1261098fb