Replace ct_server with TesseraCT in setup (#1793)

In the setup scaffolding workflow, update Fulcio to use the Static CT
log TesseraCT instead of the Trillian-based ct_server.

This change avoids retrieving the Fulcio roots from the rootCert
endpoint, instead favoring using the known externally generated root,
which closer simulates the mechanism for distributing key material out
of band via TUF. This means the createctconfig job is not needed for
this CT log. The createtree job is also no longer needed because there
is no Trillian tree to manage.

Signed-off-by: Colleen Murphy <[email protected]>

Author: cmurphy

.github/workflows/add-remove-new-fulcio.yaml

@@ -17,4 +17,3 @@ kind.yaml
 /managectroots
 /server
 /updatetree
-/verifyfulcio

.gitignore

@@ -34,21 +34,6 @@ builds:
       - -extldflags "-static"
       - "{{ .Env.LDFLAGS }}"
 
-  - id: ctlog-verifyfulcio
-    dir: ./tools/ctlog/
-    main: ./cmd/ctlog/verifyfulcio
-    env:
-      - CGO_ENABLED=0
-    flags:
-      - -trimpath
-      - -tags
-      - nostackdriver
-    ldflags:
-      - -s
-      - -w
-      - -extldflags "-static"
-      - "{{ .Env.LDFLAGS }}"
-
   - id: fulcio-createcerts
     dir: ./tools/fulcio/
     main: ./cmd/fulcio/createcerts

.ko.yaml

@@ -132,7 +132,7 @@ ko-apply-gettoken:
 	ko apply -f ./testdata/config/gettoken
 
 .PHONY: build
-build: build-tuf-server build-cloudsqlproxy build-ctlog-createctconfig build-ctlog-managectroots build-ctlog-verifyfulcio build-fulcio-createcerts build-getoidctoken build-rekor-createsecret build-trillian-createdb build-trillian-createtree build-trillian-updatetree build-tsa-createcertchain build-tuf-createsecret
+build: build-tuf-server build-cloudsqlproxy build-ctlog-createctconfig build-ctlog-managectroots build-fulcio-createcerts build-getoidctoken build-rekor-createsecret build-trillian-createdb build-trillian-createtree build-trillian-updatetree build-tsa-createcertchain build-tuf-createsecret
 
 .PHONY: build-cloudsqlproxy
 build-cloudsqlproxy:
@@ -146,10 +146,6 @@ build-ctlog-createctconfig:
 build-ctlog-managectroots:
 	go build -trimpath ./tools/ctlog/cmd/ctlog/managectroots
 
-.PHONY: build-ctlog-verifyfulcio
-build-ctlog-verifyfulcio:
-	go build -trimpath ./tools/ctlog/cmd/ctlog/verifyfulcio
-
 .PHONY: build-fulcio-createcerts
 build-fulcio-createcerts:
 	go build -trimpath ./tools/fulcio/cmd/fulcio/createcerts