Drop tuf client dependency on GCS client library

[imjasonh]

Signed-off-by: Jason Hall jason@chainguard.dev

cc @haydentherapper @asraa

Requests to get TUF roots from Google Cloud Storage are made using HTTP directly, without using the GCS client library.

[codecov-commenter]

Codecov Report

Merging #1967 (65641cc) into main (75b2bd1) will decrease coverage by 0.14%.
The diff coverage is 85.71%.

@@            Coverage Diff             @@
##             main    #1967      +/-   ##
==========================================
- Coverage   34.80%   34.66%   -0.15%     
==========================================
  Files         153      152       -1     
  Lines       10119    10089      -30     
==========================================
- Hits         3522     3497      -25     
+ Misses       6226     6222       -4     
+ Partials      371      370       -1     

Impacted Files	Coverage Δ
pkg/cosign/tuf/client.go	63.99% <85.71%> (-0.73%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 75b2bd1...65641cc. Read the comment docs.

[haydentherapper]

cc @asraa

[asraa]

Can we just use an HTTP remote store?

https://github.com/theupdateframework/go-tuf/blob/ad96eca0239ec2cc9b6e408fbe42b2f9e9d6b1dd/client/remote_store.go#L31

If it's a little hard to understand, I can take a closer look too

[asraa]

Oops, did not mean to approve, just meant to comment

[imjasonh]

Can we just use an HTTP remote store?

https://github.com/theupdateframework/go-tuf/blob/ad96eca0239ec2cc9b6e408fbe42b2f9e9d6b1dd/client/remote_store.go#L31

If it's a little hard to understand, I can take a closer look too

That seems like a good idea. I believe the previous behavior was just to interpret a mirror name like "sigstore-tuf-root" to mean a GCS bucket, and in that case, we can just upgrade that string to a URL like "https://sigstore-tuf-root.storage.googleapis.com" and use the HTTP client. More red lines! 🎉

[asraa]

I believe the previous behavior was just to interpret a mirror name like "sigstore-tuf-root" to mean a GCS bucket, and in that case, we can just upgrade that string to a URL like "https://sigstore-tuf-root.storage.googleapis.com" and use the HTTP client. More red lines!

Exactly!! Let's do it! The less code the less... bugs? (I hope!) Thank you :D

[imjasonh]

This change cuts 2MB off the size of cosign:

(drop-gcs)$ go build ./cmd/cosign/ && ls -lh cosign && rm cosign
-rwxr-xr-x  1 jason  staff    85M Jun  7 11:42 cosign

(main)$ go build ./cmd/cosign/ && ls -lh cosign && rm cosign
-rwxr-xr-x  1 jason  staff    87M Jun  7 11:42 cosign

[dlorenc]

This change cuts 2MB off the size of cosign:

NICE

[dlorenc]

Nooo, one last docgen update