Add TLS support for migrillian

[fghanmi]

Summary

This pull request introduces the option to specify a CA certificate for establishing secure connections with the Trillian server.
By using --trillian_tls_ca_cert_file flag, users can provide a CA certificate, that is used to establish a secure communication with Trillian server.

Release Note

• Feature: Added support for TLS security for Trillian server.
  New Flag: --trillian_tls_ca_cert_file to specify the file path to the CA certificate.
  Behavior: If --trillian_tls_ca_cert_file flag is not provided, the system will default to insecure connections.
  Security: This update significantly enhances the security of data in transit by enabling TLS.

Resolves Issue: #1524

Checklist

• I have updated the CHANGELOG.
  • Adjust the draft version number according to semantic versioning rules.
• I have updated documentation accordingly.

[fghanmi]

Hello,
It seems that "Missing permissions: cloudbuild.builds.get" prevents the build from starting/succeeding.
Could you please help ?
Thanks!

[mhutchinson]

Can you clarify in the PR description that this support is only for TLS certs signed by a CA. This does not add support for self-signed TLS certs.

[fghanmi]

Can you clarify in the PR description that this support is only for TLS certs signed by a CA. This does not add support for self-signed TLS certs.

CA certificate can be self-generated. Here, we only need the CA certificate to validate Trillian's TLS certificates to establish the secure communication.
The TLS certs signed by a CA (or self-signed TLS certs) will be used to secure CT log server (in the other issue)

[mhutchinson]

Can you clarify in the PR description that this support is only for TLS certs signed by a CA. This does not add support for self-signed TLS certs.

CA certificate can be self-generated. Here, we only need the CA certificate to validate Trillian's TLS certificates to establish the secure communication. The TLS certs signed by a CA (or self-signed TLS certs) will be used to secure CT log server (in the other issue)

Don't worry about it. Thinking about this some more, the self-signed cert method will still work using this approach as far as I can see because the end-cert is also its own root cert.

[mhutchinson]

/gcbrun

[fghanmi]

/gcbrun

I've checked the govulncheck / Run govulncheck (pull_request) error, and it seems, master does have the same issue.

[mhutchinson]

/gcbrun

I've checked the govulncheck / Run govulncheck (pull_request) error, and it seems, master does have the same issue.

Yeah that's because govulncheck isn't hermetic and so the master branch fails now, even though it passed when it was last updated. I'll try to get a PR in that fixes it 👍

[mhutchinson]

#1527

[roger2hk]

@fghanmi #1527 has been merged. Please rebase the branch.

[mhutchinson]

I was just about to merge this and noticed that you haven't updated the CHANGELOG file. Can you copy in the notes from this PR description into the CHANGELOG.md file? Thanks!

[mhutchinson]

/gcbrun