Support attesting tag signatures

[puerco]

Summary

This PR adds to gitsign the missing capability to attest tag signatures.

/cc @wlynch @cpanato

Closes #779

To test, just check out the branch and run this to see an attestation for gitsign's latest tag:

go run . show v0.14.0

{
  "type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "git@github.com:puerco/gitsign.git",
      "digest": {
        "gitTag": "59b806d0c7932446ca9375b36ea3d421cc673224",
        "sha1": "59b806d0c7932446ca9375b36ea3d421cc673224"
      }
    }
  ],
  "predicate_type": "https://gitsign.sigstore.dev/predicate/tag/v0.1",
  "predicate": {
    "signature": "-----BEGIN SIGNED MESSAGE-----\nMIIELwYJKoZIhvcNAQcCoIIEIDCCBBwCAQExDTALBglghkgBZQMEAgEwCwYJKoZI\nhvcNAQcBoIIC0TCCAs0wggJToAMCAQICFHX4oNpDnR17SVpco2KLU+Lk4cGZMAoG\nCCqGSM49BAMDMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2ln\nc3RvcmUtaW50ZXJtZWRpYXRlMB4XDTI2MDEyODE3NTAyN1oXDTI2MDEyODE4MDAy\nN1owADBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDEEyshqZPYaNaswQ7HfxREu\n3CKrEAAvf7bwQgWu93i4uN44VzJsW6dxV+7LBmUYP1wqyW03EthlUerMenbRtOOj\nggFyMIIBbjAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHQYD\nVR0OBBYEFIX1lG52urQX/ffvXImAVZvAjznAMB8GA1UdIwQYMBaAFN/T6c9WJBGW\n+ajY6ShVosYuGGQ/MCIGA1UdEQEB/wQYMBaBFGJpbGx5QGNoYWluZ3VhcmQuZGV2\nMCkGCisGAQQBg78wAQEEG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTArBgor\nBgEEAYO/MAEIBB0MG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTCBigYKKwYB\nBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6O\nAAABnAW6ZYYAAAQDAEcwRQIhAKyeO8OIbBRLAq0PBuJpDlL9m8bbUO97Scd5PFQ6\nbi1ZAiBNHC+SXcQ9tLzlPzNvKRniiKZ1UJuzX+LMt9eUYTd/1DAKBggqhkjOPQQD\nAwNoADBlAjEAquQWpoWTaWwNYU8aXRUxJTzoUsxM7Tdjgzz7mEcDsz5KD55nsFnJ\nxos0TZXioYoPAjBsmOdaJIh0zIzOj/N6B4VQr+txDqEovFwzcnDFmz2A8Y8CVUR1\nZOb6gAGmo7RDzYAxggEkMIIBIAIBATBPMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRl\ndjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlAhR1+KDaQ50de0laXKNi\ni1Pi5OHBmTALBglghkgBZQMEAgGgaTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcB\nMBwGCSqGSIb3DQEJBTEPFw0yNjAxMjgxNzUwMjdaMC8GCSqGSIb3DQEJBDEiBCC5\nj6i3ZTOxHPKTcA0Ub1oUtIxfJJ7xfbneBgnUJwakqTAKBggqhkjOPQQDAgRGMEQC\nIB8DIWqlTucRQEeSNpuEqUeVXhn4/DlYshDfwn5upV09AiB4gZOaUDX70vYSBup4\nluA5kuL+Nx6AafURfB2WxO8Krw==\n-----END SIGNED MESSAGE-----\n",
    "signer_info": [
      {
        "attributes": "MWkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjYwMTI4MTc1MDI3WjAvBgkqhkiG9w0BCQQxIgQguY+ot2UzsRzyk3ANFG9aFLSMXySe8X253gYJ1CcGpKk=",
        "certificate": "-----BEGIN CERTIFICATE-----\nMIICzTCCAlOgAwIBAgIUdfig2kOdHXtJWlyjYotT4uThwZkwCgYIKoZIzj0EAwMw\nNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl\ncm1lZGlhdGUwHhcNMjYwMTI4MTc1MDI3WhcNMjYwMTI4MTgwMDI3WjAAMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAEMQTKyGpk9ho1qzBDsd/FES7cIqsQAC9/tvBC\nBa73eLi43jhXMmxbp3FX7ssGZRg/XCrJbTcS2GVR6sx6dtG046OCAXIwggFuMA4G\nA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUhfWU\nbna6tBf99+9ciYBVm8CPOcAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y\nZD8wIgYDVR0RAQH/BBgwFoEUYmlsbHlAY2hhaW5ndWFyZC5kZXYwKQYKKwYBBAGD\nvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgE\nHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGKBgorBgEEAdZ5AgQCBHwE\negB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGcBbplhgAA\nBAMARzBFAiEArJ47w4hsFEsCrQ8G4mkOUv2bxttQ73tJx3k8VDpuLVkCIE0cL5Jd\nxD20vOU/M28pGeKIpnVQm7Nf4sy315RhN3/UMAoGCCqGSM49BAMDA2gAMGUCMQCq\n5BamhZNpbA1hTxpdFTElPOhSzEztN2ODPPuYRwOzPkoPnmewWcnGizRNleKhig8C\nMGyY51okiHTMjM6P83oHhVCv63EOoSi8XDNycMWbPYDxjwJVRHVk5vqAAaajtEPN\ngA==\n-----END CERTIFICATE-----\n"
      }
    ],
    "source": {
      "message": "v0.14.0\n",
      "object": "dd51a25b4f9fa103ca6f5cdca4183fa15cb3e627",
      "object_type": "commit",
      "tag": "v0.14.0",
      "tagger": {
        "date": "2026-01-28T17:50:26Z",
        "email": "billy@c********rd.dev",
        "name": "Billy Lynch"
      }
    }
  }
}

The git ref is resolved so it will return the commit attestation when the ref is not an an annotated tag (eg gitsign show v0.14.0^{}). Just as with commits, we will return a minimal predicate without signatures if a tag is not annotated or not signed.

Release Note

Implemented tag attestation capabilities. gitsign show will now correctly produce an attestation with a predicate capturing the tag signature.

[puerco]

FYI: I pushed another commit fix the unrelated linter nits breaking all the prs open right now

[wlynch]

Looks great! Let's break out the lint fixes into another PR.

[puerco]

OK, I've dropped the commit fixing the lints (thanks for fixing them!) and also removed the leftover field in the proto. PTAL!

[puerco]

The e2e token source seems to be flaking I'll retry to see if it works

Narrator: Little did @puerco know he would be out of luck :(