Add support for digest references to signature enforcement

[mtrmac]

This adds signedIdentity type: matchRepoDigestOrExact, and makes it the default.

With matchRepoDigestOrExact, Tag references require a signature with a matching repo:tag (Exact), digest references require a signature with a matching repo (and any tag [or digest]; RepoDigest), with the digest itself still being validated in image.UnparsedImage, independently of signature processing.

Rationale from mtrmac@6e18d30#commitcomment-19557682 for not doing a digest check in the identity matching component:

I have implemented the digest check in here—and thrown it away, it really does not make sense to me here. If a single PolicyReferenceMatch implementation does a more strict digest check than the one in UnparsedImage.Manifest, why should any of the other PolicyReferenceMatch implementations be weaker? So, this digest comparison should take place in a shared code path, e.g. prSignedBy.

But then, a strict digest equality check really only helps if we are worried about signatures with weak digest algorithms—and if a digest algorithm becomes so weak that we would not want to trust signatures which use that manifest digest algorithm, we should always reject such signatures just because they use a weak algorithm, not only when the user uses an explicit digest reference with a stronger digest algorithm. (In fact it is a fairly good bet that some users would continue to use weak algorithms in digest references long after the signatures are generated with a stronger one.)

Users can still opt into strict checking by specifying matchExact in signedIdentity.

I am not entirely happy with the matchRepoDigestOrExact name, but it’s difficult to be both precise and short, and, ultimately, when this is the default, most users won’t see it. Suggestions for improvement definitely welcome, though.

This is an alternative to #129 , and fixes #99.

[runcom]

Naming is fine with me, I've just tested this PR with docker at projectatomic/docker#213 and tests pass (TestPullWithPolicy) .

This needs a rebase though.

[runcom]

lgtm

[mtrmac]

👍