failure to get Fulcio root

[laurentsimon]

As part of the native SLSA builders for GitHub https://github.com/slsa-framework/slsa-github-generator, we use cosign API to verify binaries.
Recently users who user the builder to release their binaries have encountered problems:

goroutine 1 [running]:
github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioroots.Get.func1()
	github.com/sigstore/cosign@v1.7.2/cmd/cosign/cli/fulcio/fulcioroots/fulcioroots.go:48 +0x57
sync.(*Once).doSlow(0xc000be3b30?, 0xc0008de700?)
	sync/once.go:68 +0xc2
sync.(*Once).Do(...)
	sync/once.go:59
github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioroots.Get()
	github.com/sigstore/cosign@v1.7.2/cmd/cosign/cli/fulcio/fulcioroots/fulcioroots.go:[44](https://github.com/ossf/scorecard/runs/7638656220?check_suite_focus=true#step:4:45) +0x31
github.com/sigstore/cosign/cmd/cosign/cli/fulcio.GetRoots(...)
	github.com/sigstore/cosign@v1.7.2/cmd/cosign/cli/fulcio/fulcio.go:157

The builder version is v1.0.0 from 2 months ago, and uses cosign@1.7.2. We have a more recent builder version, but not all users update promptly.

Is there a way to fix this?

/cc @asraa @ianlewis

[dlorenc]

you'll need to update to at least cosign 1.9. This will be stable going forward though!

[asraa]

@cpanato and etc -- can we do patch version releases for important fixes like this? I can prep backport patches for the fix, but we don't have a policy on which versions of cosign that we intend to backport to (e.g. maybe the last 3)

[laurentsimon]

+1 on a defined policy. Having a LTS version should also be stated clearly. As a user, I want to use the LTS version to be sure I have these fixes backported; and I want to know for how long it will be supported

[dlorenc]

When we move the transparency log features out of experimental, there will be a defined stability policy.

https://github.com/sigstore/cosign#anything-under-the-cosign_experimental-environment-variable

[dlorenc]

We can do a point release if you want to backport the code, but the API won't break after experimental comes off.