Add Sigstore TSA to the trusted root

[kommendorkapten]

Description

Sigstore will start to provide a RFC3161 Timestamping Authority, add it to the trusted root target so it can be used by the clients.

[jku]

I can do do the commit when time comes but in case it's needed: timestamp.sigstore.dev certificate chain is here:

        -----BEGIN CERTIFICATE-----
        MIICEDCCAZagAwIBAgIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwMw
        OTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Et
        c2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMC4xFTAT
        BgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYH
        KoZIzj0CAQYFK4EEACIDYgAE4ra2Z8hKNig2T9kFjCAToGG30jky+WQv3BzL+mKv
        h1SKNR/UwuwsfNCg4sryoYAd8E6isovVA3M4aoNdm9QDi50Z8nTEyvqgfDPtTIwX
        ItfiW/AFf1V7uwkbkAoj0xxco2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYE
        FIn9eUOHz9BlRsMCRscsc1t9tOsDMB8GA1UdIwQYMBaAFJjsAe9/u1H/1JUeb4qI
        mFMHic6/MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2gAMGUC
        MDtpsV/6KaO0qyF/UMsX2aSUXKQFdoGTptQGc0ftq1csulHPGG6dsmyMNd3JB+G3
        EQIxAOajvBcjpJmKb4Nv+2Taoj8Uc5+b6ih6FXCCKraSqupe07zqswMcXJTe1cEx
        vHvvlw==
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        MIIB9zCCAXygAwIBAgIUV7f0GLDOoEzIh8LXSW80OJiUp14wCgYIKoZIzj0EAwMw
        OTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Et
        c2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMDkxFTAT
        BgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZz
        aWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQUQNtfRT/ou3YATa6wB/kKTe70
        cfJwyRIBovMnt8RcJph/COE82uyS6FmppLLL1VBPGcPfpQPYJNXzWwi8icwhKQ6W
        /Qe2h3oebBb2FHpwNJDqo+TMaC/tdfkv/ElJB72jRTBDMA4GA1UdDwEB/wQEAwIB
        BjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSY7AHvf7tR/9SVHm+KiJhT
        B4nOvzAKBggqhkjOPQQDAwNpADBmAjEAwGEGrfGZR1cen1R8/DTVMI943LssZmJR
        tDp/i7SfGHmGRP6gRbuj9vOK3b67Z0QQAjEAuT2H673LQEaHTcyQSZrkp4mX7Wwk
        mF+sVbkYY5mXN+RMH13KUEHHOqASaemYWK/E
        -----END CERTIFICATE-----

This is from public-good-instance configuration, and matches https://timestamp.sigstore.dev/api/v1/timestamp/certchain.

[kommendorkapten]

I see there is no intermediate CA. Any reason to stray from a classic two tier PKI here? I was expecting us to follow CAB here with an intermediate and relying on EKU constrain for time stamping, rolling up to the same root as Fulcio (where the issuing CA EKU constrains to code sign).

I know that we operate slightly different where the TUF root is the real root of the system but not having an issuing CA looks a bit off IMHO. Following CAB recommendations is something I think we should strive for.

cc @haydentherapper

[haydentherapper]

CAB requirements are because the root CA key is offline, so an intermediate key that is online is required for a functional PKI. For our production environment, all keys are online and in the same trust boundary, so there's no added security benefit to having both a root and intermediate CA, it's just an additional key to manage.

re: using Fulcio's root, a long time ago that was discussed as an option, but we decided to not couple Fulcio with other signing authorities in the infrastructure. I'd also like to simplify the production Fulcio PKI to issue leaf certs directly off an online root, at some point in the future.

[kommendorkapten]

all keys are online and in the same trust boundary

Yeah, that's fair.

We don't have an CPS published right? Do we have one internally? I'm aware of the certificate policy for Fulcio though: https://github.com/sigstore/fulcio/blob/main/docs/certificate-specification.md

This is not related to this issue but I think the project should have those documents.

[haydentherapper]

https://github.com/sigstore/timestamp-authority/blob/main/docs/tsa-policy.md Is the policy doc though I’m sure it’s out of date.

[kommendorkapten]

See #1496 for draft PR.