Chalk may appear to hang while silently downloading cosign

[ee7]

Example

For a given binary foo, run:

chalk insert foo

with Chalk version 175f32f.

Expected behavior

Should never appear to hang; should print a status message if some potentially slow operation is happening.

Observed behavior

May appear to hang when cosign is not found. The cosign binary is 98 MiB (for x86_64 Linux), so there can be significant delay on slower connections, or for transient network issues.

No information is printed, so a user may perform a keyboard interrupt.

Possible solution

Write to stderr, something like:

cosign not found in PATH, or at '/tmp/cosign'
Downloading cosign... success

Bonus: print download progress.

Other details

When there is no network connectivity, chalk does not appear to hang. It successfully adds the chalk mark, but warns:

warn:  When collecting chalk-time artifact data, plugin implementation metsys threw an exception it didn't
       handle (artifact = /path/to/foo.

[viega]

Good idea for the interim. I was really hoping to not be dependent on the cosign tool. We're not using it to do anything too crazy, and I did start on some of the necessary work (the key generation), but also need to implement secret box on top of OpenSSL 3, which we really haven't found time to do.

[ee7]

I'm ignorant of exactly what Chalk is doing with cosign. Can it use minisign instead? My understanding was that it's supported by sigstore.

[viega]

Cool we'll check it out.

[MyNameIsMeerkat]

This has been initially addressed in PR #49 by fixing an issue that caused cosign to be downloaded way more often than intended + additional user messaging.

Support for minisign has been prototyped in a dev branch alongside the abstraction of signing primitives in general, but in doing so a lot of larger signature strategy questions were raised that need further discussion before allocating dev cycles.

More to come on this in future but for the time being the changes #49 will hopefully improve the user experience for those making use of the signing features.