Summary

Some container registries require that the client present a certificate when establishing the connection. There is currently no way of specifying this when using cosign.
This change adds four arguments that allows the users to specify the root CA, the client cert and the client key and the expected SAN name.

Release Note

• Config changes (additions, deletions, updates)
  • None
• API additions—new endpoint, new response fields, or newly accepted request parameters
  • None
• Database changes (any)
  • None
• Websocket additions or changes
  • None
• Anything noteworthy to an administrator running private sigstore instances (err on the side of over-communicating)
  • It is now possible to specify client certificates (mTLS) for container registry connections
• New features and improvements, including behavioural changes, UI changes and CLI changes
  • It is now possible to specify client certificates (mTLS) for container registry connections
• Bug fixes and fixes of previous known issues
  • None
• Deprecation warnings, breaking changes, or compatibility notes
  • None

Documentation

Documentation has been added for these new arguments added:

      --registry-cacert string                                                                   path to the X.509 CA certificate file in PEM format to be used for the connection to the registry
      --registry-client-cert string                                                              path to the X.509 certificate file in PEM format to be used for the connection to the registry
      --registry-client-key string                                                               path to the X.509 private key file in PEM format to be used, together with the 'registry-client-cert' value, for the connection to the registry
      --registry-server-name string                                                              SAN name to use as the 'ServerName' tls.Config field to verify the mTLS connection to the registry

Closes #3915