[aaronlew02]

Summary

This change updates the logic in sign-blob used to determine when Ed25519ph is disabled for Ed25519 keys (i.e., when transparency log upload is disabled) to take into account a user-provided signing config.

[codecov]

Codecov Report

❌ Patch coverage is 63.63636% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.73%. Comparing base (2ef6022) to head (c692099).
⚠️ Report is 738 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/pkg/cosign/common.go	42.85%	12 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4880      +/-   ##
==========================================
- Coverage   40.10%   37.73%   -2.37%     
==========================================
  Files         155      221      +66     
  Lines       10044    13200    +3156     
==========================================
+ Hits         4028     4981     +953     
- Misses       5530     7468    +1938     
- Partials      486      751     +265     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Hayden-IO]

LGTM. Do you have a test or command we can run to verify this?

[aaronlew02]

I added test cases for Ed25519 signing in sign-blob, which demonstrated that Ed25519 signing caused a panic ("crypto: requested hash function #0 is unavailable") on the call to GetHashType().New(), since the hash algorithm for standard Ed25519 is unspecified (crypto.Hash(0)).

To enable these test cases to pass, the scope of this PR has expanded to fix Ed25519 signing without pre-hashing in general, since I:

1. added unit tests for Ed25519 methods in KMSKeypair which further demonstrated the panic,
2. fixed the panic by adding handling of Ed25519 signing without pre-hashing in SignData and HashReader, and
3. added a test case for an unspecified hash algorithm in HashReader.

Should I extract the last three commits into a separate PR upon which this PR can depend?

[Hayden-IO]

Wow this is some deja vu from trying to deal with this in #4414. Supporting ed25519 has been a painpoint :/

Thanks for the additional updates.

Where is HashReader used such that we needed to update it?

[aaronlew02]

HashReader is used by sign-blob, specifically in getPayload. If the hashFunction passed to NewHashReader is crypto.Hash(0), the original would call .New() on the hash function, leading to a panic, but this is now handled by returning a HashReader with a Hash of nil.