Fix flaky sigstore tests on Windows

[mihaimaruseac]

Summary

It seems that I failed to properly mock Sigstore in testing and that was causing some flakiness on Windows. This should be fixed now.

I'm running each CI 5 times before sending this for review to make sure.

Release Note

NONE

Documentation

NONE

[mihaimaruseac]

Five attempts of CI all passed, so I think this is good to go

[spencerschrock]

Should we look into running unit tests without networking? I took a look at what sigstore-python does, and played around with the following (I was unable to get it to work with hatch test):

unshare --map-root-user --net pytest -v .

before:

=============================================================================== short test summary info ===============================================================================
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_artifacts - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_dsse_single_digest - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_dsse_digest_of_digests - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_dsse_digests - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_dsse_digest_of_digests_sharded - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_dsse_digests_sharded - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_mocked_prod - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_mocked_prod_oidc - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_verify_mocked_ambient - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_digest_as_bytes - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_sign_bytes_as_digest - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_not_into_json_payload - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_not_intoto_statement - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_intoto_predicate_not_matched - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_intoto_single_digest_more_than_one_digests - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_intoto_digest_of_digests_more_than_one_digests - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_intoto_digest_of_digests_invalid_root_digest - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_intoto_digest_of_shard_digests_more_than_one_digests - sigstore.errors.TUFError: Failed to refresh TUF metadata
FAILED tests/signing/sigstore_test.py::TestSigstoreSigning::test_verify_intoto_digest_of_shard_digests_invalid_root_digest - sigstore.errors.TUFError: Failed to refresh TUF metadata
=========================================================================== 19 failed, 235 passed in 6.56s ============================================================================

Testing on this PR everything passes :)

[spencerschrock]

Not 100% familiar with unittest.mock but the CI seems stable and my unshare experiment looked good 👍

[mihaimaruseac]

Running with networking disabled was a good way to test that we completely mocked out Sigstore, this is a good suggestion -- thank you. Might be too late for this now, but we can try if we detect other flakyness / need to mock other services?