Tekton task support for keyless sig checks

We're keeping the new param handling bash as light as possible. My
thinking is that ec should produce a good enough error if the params
are wrong or incorrectly specified, so we don't want or need a layer
messy bash to check that they are correct.

Ref: https://issues.redhat.com/browse/EC-1652
Co-authored-by: Claude Code <noreply@anthropic.com>

Author: simonbaird

docs/modules/ROOT/pages/verify-enterprise-contract.adoc

@@ -34,6 +34,8 @@ You can also specify a policy configuration using a git url, e.g.
 *Default*: `enterprise-contract-service/default`
 *PUBLIC_KEY* (`string`):: Public key used to verify signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute.
 *REKOR_HOST* (`string`):: Rekor host for transparency log lookups
+*CERTIFICATE_IDENTITY* (`string`):: Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing.
+*CERTIFICATE_OIDC_ISSUER* (`string`):: Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing.
 *IGNORE_REKOR* (`string`):: Skip Rekor transparency log checks during validation.
 +
 *Default*: `false`

tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml

@@ -69,6 +69,20 @@ spec:
       description: Rekor host for transparency log lookups
       default: ""
 
+    - name: CERTIFICATE_IDENTITY
+      type: string
+      description: >-
+        Expected identity in the signing certificate for keyless verification.
+        This should be the email or URI that was used when signing.
+      default: ""
+
+    - name: CERTIFICATE_OIDC_ISSUER
+      type: string
+      description: >-
+        Expected OIDC issuer in the signing certificate for keyless verification.
+        This should match the issuer that provided the identity token used for signing.
+      default: ""
+
     - name: IGNORE_REKOR
       type: string
       description: >-
@@ -245,7 +259,22 @@ spec:
           "image"
           "--images" "/tekton/home/snapshot.json"
           "--policy" "${POLICY_CONFIGURATION}"
-          "--public-key" "${PUBLIC_KEY}"
+        )
+
+        # To keep bash logic as thin as possible we deliberately don't sanitize
+        # these params. If something is wrong or missing let Conforma handle it.
+        if [ -n "${CERTIFICATE_IDENTITY}" ] && [ -n "${CERTIFICATE_OIDC_ISSUER}" ]; then
+          cmd_args+=(
+            "--certificate-identity" "${CERTIFICATE_IDENTITY}"
+            "--certificate-oidc-issuer" "${CERTIFICATE_OIDC_ISSUER}"
+          )
+        elif [ -n "${PUBLIC_KEY}" ]; then
+          cmd_args+=(
+            "--public-key" "${PUBLIC_KEY}"
+          )
+        fi
+
+        cmd_args+=(
           "--rekor-url" "${REKOR_HOST}"
           "--ignore-rekor=${IGNORE_REKOR}"
           "--workers" "${WORKERS}"
@@ -276,6 +305,10 @@ spec:
           value: "$(params.POLICY_CONFIGURATION)"
         - name: PUBLIC_KEY
           value: "$(params.PUBLIC_KEY)"
+        - name: CERTIFICATE_IDENTITY
+          value: "$(params.CERTIFICATE_IDENTITY)"
+        - name: CERTIFICATE_OIDC_ISSUER
+          value: "$(params.CERTIFICATE_OIDC_ISSUER)"
         - name: REKOR_HOST
           value: "$(params.REKOR_HOST)"
         - name: IGNORE_REKOR