Add a tlog-policy parser

[BenBirt]

No description provided.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 90.72165% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.66%. Comparing base (fa00c16) to head (88b1154).
⚠️ Report is 181 commits behind head on main.

Files with missing lines	Patch %	Lines
policy/tlog_policy.go	90.72%	9 Missing and 9 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #269      +/-   ##
==========================================
- Coverage   82.57%   79.66%   -2.91%     
==========================================
  Files           5        9       +4     
  Lines         241      890     +649     
==========================================
+ Hits          199      709     +510     
- Misses         30       99      +69     
- Partials       12       82      +70     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mhutchinson]

Looks good to me, but I'd like to have @AlCutter approve too.

[AlCutter]

FWIW, tlog-checkpoint says "The log’s key name in its signature line SHOULD match the origin line".

While mostly it'd be cool if everyone treated that as a MUST, MTC unfortunately doesn't. I think it's okay, in that Satisfied will still works even if Verify doesn't, so mostly just flagging it for thoughts rather than requesting any particular changes.

[BenBirt]

This comes from https://c2sp.org/tlog-policy#defining-a-log: "name MUST correspond to the log's origin line".

It's tricky because - as far as tlog-policy is concerned, I think (?) this must hold true (for at least Verify) to be able to function.

But yeah, tlog-checkpoint clearly differs on this point, presumably to allow flexibility in how checkpoints are verified.

I think this probably nets out as: usecases in which the key name in the signature does NOT match the origin line should not use tlog-policy (at least not with log lines specified - remember they are optional). And if/when there are well-specified mechanisms for identifying the origin signatures in the checkpoint, we should update tlog-policy to include those (if at all possible).

WDYT?

[AlCutter]

Yeah, that seems reasonable.

[BenBirt]

cc @rgdd @niels-moller who might be interested in this discussion