Add Rekor v2 mode, Ed25519ph, and persistent duplicate handling

.github/workflows/ci.yml

@@ -10,14 +10,35 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: "1.95.0"
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo install cargo-audit --locked
+      - name: Audit dependencies
+        run: |
+          # rsa is only in SQLx's disabled MySQL lockfile graph. Never allow
+          # this timing-side-channel exception to cover an enabled dependency.
+          cargo tree --color never --locked --workspace --all-features --edges normal --prefix none > /tmp/dependencies.txt
+          if grep -Eq '^rsa v' /tmp/dependencies.txt; then
+            echo 'rsa is enabled: revisit RUSTSEC-2023-0071 before shipping'
+            exit 1
+          fi
+          cargo audit --ignore RUSTSEC-2023-0071
+
   fmt:
     name: Format
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.90"
+          toolchain: "1.95.0"
           components: rustfmt
       - name: Check formatting
         run: cargo fmt --all -- --check
@@ -29,11 +50,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.90"
+          toolchain: "1.95.0"
           components: clippy
       - uses: Swatinem/rust-cache@v2
       - name: Clippy
-        run: cargo clippy --all-targets --all-features -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
   build:
     name: Build
@@ -42,19 +63,43 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.90"
+          toolchain: "1.95.0"
       - uses: Swatinem/rust-cache@v2
       - name: Build
-        run: cargo build --all-targets
+        run: cargo build --workspace --all-targets
 
   test:
     name: Test
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: siglog_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      SIGLOG_TEST_POSTGRES_URL: postgres://postgres:test@localhost:5432/siglog_test
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.90"
+          toolchain: "1.95.0"
       - uses: Swatinem/rust-cache@v2
       - name: Run tests
         run: cargo test --all
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: rekor-conformance/go.mod
+          cache-dependency-path: rekor-conformance/go.sum
+      - name: Rekor v2 interoperability
+        run: |
+          cargo build --bin siglog
+          cd rekor-conformance
+          go test -v -count=1