Add Sigstore sign/verify to CLI

[font]

Summary

• Update to support Sigstore sign via CLI
• Update to support Sigstore verify via CLI
• Update docs for Sigstore sign/verify CLI
• Update doc to reflect latest CLI changes

Release Note

Documentation

[mihaimaruseac]

I like this. Two more things to do:

• can we make sigstore signing method be the default?
• can you fix the failing lint CI?

[font]

@mihaimaruseac Thanks for the review!

• can we make sigstore signing method be the default?

I don't think we can do this as there doesn't appear to be a way to set a default subparser, and if no method is specified on the command line, that parser's Namespace object does not contain the option attributes defined for it. I may have to look more into seeing if there's a way to do this. Let me know if you have any suggestions.

• can you fix the failing lint CI?

Done

[font]

@mihaimaruseac This is ready for re-review.

[mihaimaruseac]

I don't think we can do this as there doesn't appear to be a way to set a default subparser, and if no method is specified on the command line, that parser's Namespace object does not contain the option attributes defined for it. I may have to look more into seeing if there's a way to do this. Let me know if you have any suggestions.

We can use set_defaults. I did something similar in the benchmarks:

model-transparency/benchmarks/generate.py

Line 186 in 9e133c4

parser.set_defaults(func=generate_file)

[font]

We can use set_defaults. I did something similar in the benchmarks:

model-transparency/benchmarks/generate.py

Line 186 in 9e133c4

parser.set_defaults(func=generate_file)

Thanks @mihaimaruseac!

I had looked at the set_defaults approach and even tried it, but it seems it's mostly a good way to organize different functionality into its own code paths.

That is, the generate.py code runs into the same problem. Namely that when there's options that are part of a positional argument, those options never get added to that positional argument, or parser's, Namespace object. Here's the specific error:

→ python generate.py 
Traceback (most recent call last):
  File "model-transparency/benchmarks/generate.py", line 227, in <module>
    args.func(args)
  File "model-transparency/benchmarks/generate.py", line 81, in generate_file
    create_file_of_given_size(args.root, args.size)
                              ^^^^^^^^^
AttributeError: 'Namespace' object has no attribute 'root'

So I'm not sure there's a good way to set a default for a required positional argument that also has its own options unless we just start manipulating the Namespace object directly. But that feels a little kludgy. Thoughts?

[mihaimaruseac]

Oh, I only tested with -h :(

In this case, let's merge this as it is and then move towards merging the sign and verify CLI scripts into a single one, as then we could make the signer be set via a flag, with defaults.