Improve Verification on signing PRs: Detect correct repository and filtering output

[asraa]

cc @kommendorkapten

Description

Currently, verifiers run something like:

REPO=ceremony/YYYY-MM-DD ./scripts/verify.sh

This script runs an entire suite of verification commands that can apply to any type of PR run or repository (incomplete, complete).

root-signing/scripts/verify.sh

Lines 55 to 66 in 4c151b3

	# Verify keys if keys/ repository exists. It does not in the top-level published repository/
	if [ -d "$REPO"/keys ]; then
	./verify keys --root piv-attestation-ca.pem --key-directory "$REPO"/keys
	fi
	# If staged metadata exists, verify the staged repository
	if [ -f "$REPO"/staged/root.json ]; then
	./verify repository --repository "$REPO" --staged
	fi
	# If published data exists, verify against a root
	if [ -f "$REPO"/repository/1.root.json ]; then
	./verify repository --repository "$REPO" --root "$REPO"/repository/1.root.json
	fi

Instead, there are really only a few types of events verifiers need to look for:

• Verification of committed HSM key data only (used for initializing new metadata, no signatures present). This is the key command

  root-signing/cmd/verify/app/keys.go

  Line 182 in 4c151b3

  rootCmd.AddCommand(keyCmd)

• Verification of some present signatures (for any signing events). This is "verifying staged metadata" in here.
• Verification of a full entire-ty of metadata. This is the verify metadata without the staged sub-command.

Idea:

• Separate verification commands ./scripts/verify-signing.sh or ./scripts/verify-snapshot-timestamp.sh or ./scripts/verify-metadata.sh, ./scripts/verify-keys.sh, or give a select prompt if we want to maintain the single ./scripts/verify.sh` entrypoint. Document what users are expected to do in the different PR scenarios.
• Separate the VerifyCmd to VerifyStagedCmd and VerifyRepositoryCmd to make it clear/subcommands.

Version

[asraa]

@kommendorkapten also brings the point of when verifying newly initialized metadata and we don't expect any sigs, we are also looking to identify other properties than keys: is the data well-formed? what are the expiries? This isn't handled by any of the commands right now.

Also: that probably makes sense under verifyStagedMetadata. Verifying signatures probably should be called verifySignatures at a top-level