expand LoadPrivateKey in pkg/cosign to support Sigstore Encrypted EC keys ("EC PRIVATE KEY" format)

[dmitris]

Description

Currently LoadPrivateKey fails if given a Sigstore Encrypted private key. Adding a key as pemcosigneckey below and trying to use it in the unit test TestReadingPrivatePemTypes produces an error: parsing private key: x509: failed to parse private key (use ParseECPrivateKey instead for this key format). Currently, the LoadPrivateKey function assumes the PKCS8 encoding and calls only x509.ParsePKCS8PrivateKey -

cosign/pkg/cosign/keys.go

Line 223 in ca682f2

pk, err := x509.ParsePKCS8PrivateKey(x509Encoded)

If this is a "conscious" requirement, we should document it (and add unit tests with expected failure) - otherwise
let's expand LoadPrivateKey to try different x509 parsing functions to load private keys, at least ParsePKCS8PrivateKey and ParseECPrivateKey, maybe also [ParsePKCS1PrivateKey.

// COSIGN labeled EC key
const pemcosigneckey = `-----BEGIN ENCRYPTED COSIGN PRIVATE KEY-----
eyJrZGYiOnsibmFtZSI6InNjcnlwdCIsInBhcmFtcyI6eyJOIjo2NTUzNiwiciI6
OCwicCI6MX0sInNhbHQiOiJHK3F5WTYrNzhNS0JzMXNGTGs1ajYwcS9kS3Z1czBW
VkhlSHZybC9POTF3PSJ9LCJjaXBoZXIiOnsibmFtZSI6Im5hY2wvc2VjcmV0Ym94
Iiwibm9uY2UiOiJRc2JGdG13WDRDK2ttV3ZCcVRaMEFGOUFYdk1jRmg1SCJ9LCJj
aXBoZXJ0ZXh0IjoiREM5T28zeldiYVQzSXYwdFVnWEdycjUxYW1samwwNlQ5MTNP
VkxPbWpuMWhnK2o2WXRUbWg3SGhZSlY1N2J5eGE0Q281bE9YYmRqbTJ3aklubEd1
Um5aZCt5OExnekpSNzFSeEhKVzgrWmRlcFJmYWJMTjdHbDgrSFZEcERVQ3NxQnRh
VngyblpGbFEwWUl1anZwbFphblNGaUVvdERLVGkxZ3VhUXIwUHNzYU01NXZxbTRY
WS9rPSJ9
-----END ENCRYPTED COSIGN PRIVATE KEY-----`

test case

		{
			pemType:  "COSIGN PEM EC Type",
			pemData:  []byte(pemcosigneckey),
			expected: nil,
		},

Test error:

 $ go test -v -run TestReadingPrivatePemTypes/COSIGN_PEM_EC_Type
=== RUN   TestReadingPrivatePemTypes
=== RUN   TestReadingPrivatePemTypes/COSIGN_PEM_EC_Type
    keys_test.go:358:
        	Error Trace:	/Users/dmitris/gh/sigstore/cosign/pkg/cosign/keys_test.go:358
        	Error:      	Not equal:
        	            	expected: <nil>(<nil>)
        	            	actual  : *fmt.wrapError(&fmt.wrapError{msg:"parsing private key: x509: failed to parse private key (use ParseECPrivateKey instead for this key format)", err:(*errors.errorString)(0x14000a00040)})
        	Test:       	TestReadingPrivatePemTypes/COSIGN_PEM_EC_Type
--- FAIL: TestReadingPrivatePemTypes (0.12s)
    --- FAIL: TestReadingPrivatePemTypes/COSIGN_PEM_EC_Type (0.12s)
FAIL
exit status 1
FAIL	github.com/sigstore/cosign/v2/pkg/cosign	0.784s

[dmitris]

closing per comments