VSA POC

[joejstuart]

Checks if VSA exists before validation. If a VSA exists, it will display the results stored in it as the report.

If a VSA does not exist, runs validation, then generates and stores a VSA in Rekor.

This accepts a new argument --attestor-key which is a private key to sign the VSA

ec validate image \
  --image quay.io/redhat-user-workloads/rhtap-contract-tenant/golden-container/golden-container@sha256:ad333bfa53d18c684821c85bfa8693e771c336f0ba1a286b3a6ec37dd95a232e \
  --policy github.com/joejstuart/ec-config//slsa3-failed?ref=volatile-test \
  --public-key pub.key \
  --ignore-rekor \
  --output "text?show-successes=false" \
  --output appstudio \
  --show-successes \
  --info \
  --attestor-key cosign.key