disallow key and cert identity being used together during verification

[piceri]

Summary

Closes #4617

This pull request forces a failure when both the --key and --certificate-identity flags are used when trying to verify. This will avoid confusion as to which method was used to verify and prompt users to only provide one or the other.

Release Note

Changed verify and verify-blob to not allow --key and --certificate-identity to be used together

Documentation

[codecov]

Codecov Report

❌ Patch coverage is 61.53846% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 36.58%. Comparing base (2ef6022) to head (c491b79).
⚠️ Report is 651 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/options/errors.go	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4636      +/-   ##
==========================================
- Coverage   40.10%   36.58%   -3.53%     
==========================================
  Files         155      220      +65     
  Lines       10044    12624    +2580     
==========================================
+ Hits         4028     4618     +590     
- Misses       5530     7305    +1775     
- Partials      486      701     +215     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Hayden-IO]

Thanks! Can we also update verify-attestation and verify-blob-attestation? Can we have a shared method for verifying this called by the four verify-* commands?

[Hayden-IO]

Can you add a little bit more about what to do when you get this error? How should you know whether to provide a key or identity?

[piceri]

Thanks! Can we also update verify-attestation and verify-blob-attestation? Can we have a shared method for verifying this called by the four verify-* commands?

As I went to add the other verify commands, I found the NOf function being used to do similar mutually exclusive checks and copied that pattern.

I also was looking deeper at the options and noticed CertIdentityRegex and I believe that should be added to the check as well as it appears to be an alternative to CertIdentity. This did cause an e2e test to fail. I did my best to dig into that test and I believe it ok to remove the CertVerifyOptions as the validation is done by key, but please double check me here.

[Hayden-IO]

Thanks, this looks great!

[Hayden-IO]

This will also cover the older Cosign bundle format - https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md#properties - so we should mention a certificate could be under this as well.