[feature] Improve package signing plugin integration: new commands, tools and output format

[danimtb]

Changelog: Feature: Improve package signing plugin integration.
Changelog: Feature: Add conan cache sign and conan cache verify commands for package signing.
Changelog Feature: Standardize package summary format with files, checksums, signing method and signing provider.
Docs: missing

• Added new commands for sign and verify.
• Added text and json format output.
• Manage errors and messages (warnings too) for the report.
• Added context parameter to decide the behavior of the plugin when uploading, installing or just managing the signatures from the cache.
• Added tools to create a package summary json file wtih files, checkusms, signing methof and signing provider.
• Managed output with package lists.
• Error management in the upload command when signing packages.

[memsharded]

This is doing a checksum of all artifacts in the package?
What exactly for?

[danimtb]

We agreed that this should be the way the plugin should work. Get the cheksums of all the contetns of the package, create a summary file with filenames and checkesums and use that file to sign the package

[memsharded]

But maybe, this is the kind of thing that shouldn't belong then to user space? This is something that Conan should kind of enforce in the plugin? Or do we still envision other possible signing approaches that do not sign this file?

[czoido]

@danimtb what about something like this for the output? I think it may be more readable?
In the first one I also added the # for the rrev and the : for the package id but I think that they are not adding much? The others don't have that notation.

$ conan cache sign *

Found 3 pkg/version recipes matching * in local cache

[Package signing] Signing packages in local cache...

lib1ok/0.1
  #a5e2af5522a1edcab963447eec649700
  recipe: OK
  packages
    :da39a3ee5e6b4b0d3255bfef95601890: OK

lib2fail/0.1
  #70a185be5a95af3dde25b74ae800b2f2
  recipe: WARN (already signed by another provider)
  packages
    :da39a3ee5e6b4b0d3255bfef95601890: WARN (already signed by another provider)

lib3fail/0.1
  #09ccc766ddd11c96aa78307b3f166fd6
  recipe: FAIL (sign failed)
  packages
    :da39a3ee5e6b4b0d3255bfef95601890: FAIL (sign failed)

[Package signing] Summary: OK=3, WARN=2, FAILED=2

$ conan cache verify *

Found 3 pkg/version recipes matching * in local cache

[Package signing] Verifying signatures in local cache...

lib1ok/0.1
  a5e2af5522a1edcab963447eec649700
  recipe: OK
  packages
    da39a3ee5e6b4b0d3255bfef95601890: OK

lib2fail/0.1
  70a185be5a95af3dde25b74ae800b2f2
  recipe: FAIL (wrong provider)
  packages
    da39a3ee5e6b4b0d3255bfef95601890: FAIL (wrong provider)
    da39agfffg34234ff22424f4490fef95: OK
    4b0d3255bfef9560189da39a3ee5e6b0: FAIL (wrong provider)

lib3fail/0.1
  09ccc766ddd11c96aa78307b3f166fd6
  recipe: FAIL (Package is not signed)
  packages
    da39a3ee5e6b4b0d3255bfef95601890: FAIL (Package is not signed)

[Package signing] Summary: OK=3, WARN=0, FAILED=5

$ conan upload * -c -r default

Found 3 pkg/version recipes matching * in local cache

======== Uploading to remote default ========

-------- Checking server for existing packages --------
lib1ok/0.1: Checking which revisions exist in the remote server
lib2fail/0.1: Checking which revisions exist in the remote server
lib3fail/0.1: Checking which revisions exist in the remote server

-------- Preparing artifacts for upload --------
lib1ok/0.1:da39a3ee5e6b4b0d3255bfef95601890: Compressing conan_package.tgz
lib2fail/0.1:da39a3ee5e6b4b0d3255bfef95601890: Compressing conan_package.tgz
lib3fail/0.1:da39a3ee5e6b4b0d3255bfef95601890: Compressing conan_package.tgz

[Package signing] Signing packages before upload...

lib1ok/0.1
  a5e2af5522a1edcab963447eec649700
  recipe: OK (already signed by the same provider)
  packages
    da39a3ee5e6b4b0d3255bfef95601890: OK (already signed by the same provider)

lib2fail/0.1
  70a185be5a95af3dde25b74ae800b2f2
  recipe: WARN (already signed by another provider)
  packages
    da39a3ee5e6b4b0d3255bfef95601890: WARN (already signed by another provider)

lib3fail/0.1
  09ccc766ddd11c96aa78307b3f166fd6
  recipe: FAIL (sign failed)
  packages
    da39a3ee5e6b4b0d3255bfef95601890: FAIL (sign failed)

[Package signing] Summary: OK=3, WARN=2, FAILED=2

ERROR: Upload aborted: package signing failed
  lib3fail/0.1#09ccc766ddd11c96aa78307b3f166fd6
    reason: sign failed

[danimtb]

Superseded by #19345