add dsse type

[bobcallaway]

Summary

This adds a new pluggable type dsse, which adds entries for DSSE JSON documents which are often used with in-toto attestations. There are a few significant differences between this dsse type and the already existing intoto types:

• The JSON schema more clearly separates the proposed entry from what is persisted to simplify client expectations
• The DSSE envelope is provided as a JSON string, rather than double-encoding values in base64
• The DSSE envelope is not stored by Rekor; this is to set the client expectation that attestation storage in Rekor should not be relied upon for attestation discovery.

Release Note

• Adds a new entry type dsse which persisted information about DSSE envelopes without storing the envelope in Rekor

Documentation

• Add docs on type to docs.sigstore.dev

[codecov]

Codecov Report

Merging #1487 (8ecef3c) into main (43be4d8) will increase coverage by 0.53%.
The diff coverage is 75.49%.

@@            Coverage Diff             @@
##             main    #1487      +/-   ##
==========================================
+ Coverage   66.48%   67.01%   +0.53%     
==========================================
  Files          80       82       +2     
  Lines        8023     8325     +302     
==========================================
+ Hits         5334     5579     +245     
- Misses       2038     2077      +39     
- Partials      651      669      +18     

Flag	Coverage Δ
e2etests	48.50% <61.58%> (+0.66%)	⬆️
unittests	47.50% <62.79%> (+0.68%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
cmd/rekor-cli/app/root.go	66.66% <ø> (ø)
pkg/types/dsse/v0.0.1/entry.go	72.99% <72.99%> (ø)
cmd/rekor-server/app/serve.go	84.81% <100.00%> (+0.19%)	⬆️
pkg/types/dsse/dsse.go	100.00% <100.00%> (ø)

... and 5 files with indirect coverage changes

[AdamKorcz]

Fuzzing-part looks good!

[bdehamer]

Thanks for tackling this. Looking forward to using this in place of the intoto type!

[codysoyland]

Great stuff, thank @bobcallaway! 🎉

[jul-sh]

The DSSE envelope is not stored by Rekor; this is to set the client expectation that attestation storage in Rekor should not be relied upon for attestation discovery.

@bobcallaway to confirm, is this the desired expectation for for all rekor entries or specific to the DSSE type?

Rekor's search functionality, as well as its UI for viewing in-toto SLSA provenances positioned it as a useful tool for attestation discovery.