add Hellō provider

[dickhardt]

Summary

Adds Hellō (https://issuer.hello.coop) as an IdP for email

#1683

Release Note

Adding issuer.hello.coop to Fulcio

Hellō meets the requirements defined in https://github.com/sigstore/fulcio/blob/main/docs/new-idp-requirements.md

• Issuer keys are managed by KMS, rotated automatically every 30 days.
• 'sigstore' client is configured, and works with localhost redirect and device flow
• all emails are verified
• sub is a GUID generated on each new user

Documentation

Not at this time

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 48.61%. Comparing base (cf238ac) to head (d13772a). Report is 108 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1684      +/-   ##
==========================================
- Coverage   57.93%   48.61%   -9.33%     
==========================================
  Files          50       67      +17     
  Lines        3119     4042     +923     
==========================================
+ Hits         1807     1965     +158     
- Misses       1154     1862     +708     
- Partials      158      215      +57     

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[dickhardt]

@bobcallaway @haydentherapper -- next steps for this PR?

This would increase the options developers have if they want to opt into using Hellō.

[dickhardt]

@bobcallaway @haydentherapper -- it has been a month since my last bump. While the docs encourage PRs -- this has not been a great experience as a contributor. :(

[Hayden-IO]

@dickhardt As mentioned at the conference, we'll be discussing adding new providers in the next TSC meeting. There has not been a TSC meeting since the conference due to the 4th being a holiday, it'll be discussed in the next.

[dickhardt]

@haydentherapper ... and the next one is when?

[Hayden-IO]

Thursday, the 18th.

[Hayden-IO]

You’ll just need to update where you declare the new provider, it’s under a new yaml config.