Address review comments

haydentherapper · haydentherapper · commit 81e920f63719 · 2025-09-04T10:54:23.000-07:00
--signing-config and --use-signing-config are now mutually exclusive.

TrustedMaterial and SigningConfig are set in the same line as fetching
the trusted root and signing config.

Signed-off-by: Hayden &lt;8418760+haydentherapper@users.noreply.github.com&gt;
diff --git a/cmd/cosign/cli/attest.go b/cmd/cosign/cli/attest.go
@@ -113,29 +113,26 @@ func Attest() *cobra.Command {
 						return fmt.Errorf("loading trusted root: %w", err)
 					}
 				} else {
-					trustedMaterial, err := cosign.TrustedRoot()
+					ko.TrustedMaterial, err = cosign.TrustedRoot()
 					if err != nil {
 						ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
 					}
-					ko.TrustedMaterial = trustedMaterial
 				}
 			}
 
 			if (o.UseSigningConfig || o.SigningConfigPath != "") && !o.NewBundleFormat {
 				return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")
 			}
 			if o.UseSigningConfig {
-				signingConfig, err := cosign.SigningConfig()
+				ko.SigningConfig, err = cosign.SigningConfig()
 				if err != nil {
 					return fmt.Errorf("error getting signing config from TUF: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			} else if o.SigningConfigPath != "" {
-				signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)
+				ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
 				if err != nil {
 					return fmt.Errorf("error reading signing config from file: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			}
 
 			attestCommand := attest.AttestCommand{
diff --git a/cmd/cosign/cli/attest_blob.go b/cmd/cosign/cli/attest_blob.go
@@ -101,28 +101,25 @@ func AttestBlob() *cobra.Command {
 						return fmt.Errorf("loading trusted root: %w", err)
 					}
 				} else {
-					trustedMaterial, err := cosign.TrustedRoot()
+					ko.TrustedMaterial, err = cosign.TrustedRoot()
 					if err != nil {
 						ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
 					}
-					ko.TrustedMaterial = trustedMaterial
 				}
 			}
 			if (o.UseSigningConfig || o.SigningConfigPath != "") && o.BundlePath == "" {
 				return fmt.Errorf("must provide --bundle with --signing-config or --use-signing-config")
 			}
 			if o.UseSigningConfig {
-				signingConfig, err := cosign.SigningConfig()
+				ko.SigningConfig, err = cosign.SigningConfig()
 				if err != nil {
 					return fmt.Errorf("error getting signing config from TUF: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			} else if o.SigningConfigPath != "" {
-				signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)
+				ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
 				if err != nil {
 					return fmt.Errorf("error reading signing config from file: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			}
 
 			v := attest.AttestBlobCommand{
diff --git a/cmd/cosign/cli/options/attest.go b/cmd/cosign/cli/options/attest.go
@@ -124,6 +124,8 @@ func (o *AttestOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
 		"path to a signing config file. Must provide --new-bundle-format, which will store verification material in the new format")
 
+	cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
+
 	cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
 		"optional path to a TrustedRoot JSON file to verify a signature after signing")
 }
diff --git a/cmd/cosign/cli/options/attest_blob.go b/cmd/cosign/cli/options/attest_blob.go
@@ -109,6 +109,8 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
 		"path to a signing config file. Must provide --bundle, which will output verification material in the new format")
 
+	cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
+
 	cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
 		"optional path to a TrustedRoot JSON file to verify a signature after signing")
 
diff --git a/cmd/cosign/cli/options/sign.go b/cmd/cosign/cli/options/sign.go
@@ -152,6 +152,8 @@ func (o *SignOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
 		"path to a signing config file. Must provide --new-bundle-format, which will store verification material in the new format")
 
+	cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
+
 	cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
 		"optional path to a TrustedRoot JSON file to verify a signature after signing")
 }
diff --git a/cmd/cosign/cli/options/signblob.go b/cmd/cosign/cli/options/signblob.go
@@ -92,6 +92,8 @@ func (o *SignBlobOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
 		"path to a signing config file. Must provide --bundle, which will output verification material in the new format")
 
+	cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
+
 	cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
 		"optional path to a TrustedRoot JSON file to verify a signature after signing")
 
diff --git a/cmd/cosign/cli/sign.go b/cmd/cosign/cli/sign.go
@@ -143,29 +143,26 @@ race conditions or (worse) malicious tampering.
 						return fmt.Errorf("loading trusted root: %w", err)
 					}
 				} else {
-					trustedMaterial, err := cosign.TrustedRoot()
+					ko.TrustedMaterial, err = cosign.TrustedRoot()
 					if err != nil {
 						ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
 					}
-					ko.TrustedMaterial = trustedMaterial
 				}
 			}
 
 			if (o.UseSigningConfig || o.SigningConfigPath != "") && !o.NewBundleFormat {
 				return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")
 			}
 			if o.UseSigningConfig {
-				signingConfig, err := cosign.SigningConfig()
+				ko.SigningConfig, err = cosign.SigningConfig()
 				if err != nil {
 					return fmt.Errorf("error getting signing config from TUF: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			} else if o.SigningConfigPath != "" {
-				signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)
+				ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
 				if err != nil {
 					return fmt.Errorf("error reading signing config from file: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			}
 
 			if err := sign.SignCmd(ro, ko, *o, args); err != nil {
diff --git a/cmd/cosign/cli/signblob.go b/cmd/cosign/cli/signblob.go
@@ -111,28 +111,25 @@ func SignBlob() *cobra.Command {
 						return fmt.Errorf("loading trusted root: %w", err)
 					}
 				} else {
-					trustedMaterial, err := cosign.TrustedRoot()
+					ko.TrustedMaterial, err = cosign.TrustedRoot()
 					if err != nil {
 						ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
 					}
-					ko.TrustedMaterial = trustedMaterial
 				}
 			}
 			if (o.UseSigningConfig || o.SigningConfigPath != "") && o.BundlePath == "" {
 				return fmt.Errorf("must provide --bundle with --signing-config or --use-signing-config")
 			}
 			if o.UseSigningConfig {
-				signingConfig, err := cosign.SigningConfig()
+				ko.SigningConfig, err = cosign.SigningConfig()
 				if err != nil {
 					return fmt.Errorf("error getting signing config from TUF: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			} else if o.SigningConfigPath != "" {
-				signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)
+				ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
 				if err != nil {
 					return fmt.Errorf("error reading signing config from file: %w", err)
 				}
-				ko.SigningConfig = signingConfig
 			}
 
 			for _, blob := range args {

Original file line number	Diff line number	Diff line change
`@@ -113,29 +113,26 @@ func Attest() *cobra.Command {`
`113`	`113`	`return fmt.Errorf("loading trusted root: %w", err)`
`114`	`114`	`}`
`115`	`115`	`} else {`
`116`		`- trustedMaterial, err := cosign.TrustedRoot()`
	`116`	`+ ko.TrustedMaterial, err = cosign.TrustedRoot()`
`117`	`117`	`if err != nil {`
`118`	`118`	`ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)`
`119`	`119`	`}`
`120`		`- ko.TrustedMaterial = trustedMaterial`
`121`	`120`	`}`
`122`	`121`	`}`
`123`	`122`
`124`	`123`	`if (o.UseSigningConfig \|\| o.SigningConfigPath != "") && !o.NewBundleFormat {`
`125`	`124`	`return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")`
`126`	`125`	`}`
`127`	`126`	`if o.UseSigningConfig {`
`128`		`- signingConfig, err := cosign.SigningConfig()`
	`127`	`+ ko.SigningConfig, err = cosign.SigningConfig()`
`129`	`128`	`if err != nil {`
`130`	`129`	`return fmt.Errorf("error getting signing config from TUF: %w", err)`
`131`	`130`	`}`
`132`		`- ko.SigningConfig = signingConfig`
`133`	`131`	`} else if o.SigningConfigPath != "" {`
`134`		`- signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)`
	`132`	`+ ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)`
`135`	`133`	`if err != nil {`
`136`	`134`	`return fmt.Errorf("error reading signing config from file: %w", err)`
`137`	`135`	`}`
`138`		`- ko.SigningConfig = signingConfig`
`139`	`136`	`}`
`140`	`137`
`141`	`138`	`attestCommand := attest.AttestCommand{`
Original file line number	Diff line number	Diff line change
`@@ -101,28 +101,25 @@ func AttestBlob() *cobra.Command {`
`101`	`101`	`return fmt.Errorf("loading trusted root: %w", err)`
`102`	`102`	`}`
`103`	`103`	`} else {`
`104`		`- trustedMaterial, err := cosign.TrustedRoot()`
	`104`	`+ ko.TrustedMaterial, err = cosign.TrustedRoot()`
`105`	`105`	`if err != nil {`
`106`	`106`	`ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)`
`107`	`107`	`}`
`108`		`- ko.TrustedMaterial = trustedMaterial`
`109`	`108`	`}`
`110`	`109`	`}`
`111`	`110`	`if (o.UseSigningConfig \|\| o.SigningConfigPath != "") && o.BundlePath == "" {`
`112`	`111`	`return fmt.Errorf("must provide --bundle with --signing-config or --use-signing-config")`
`113`	`112`	`}`
`114`	`113`	`if o.UseSigningConfig {`
`115`		`- signingConfig, err := cosign.SigningConfig()`
	`114`	`+ ko.SigningConfig, err = cosign.SigningConfig()`
`116`	`115`	`if err != nil {`
`117`	`116`	`return fmt.Errorf("error getting signing config from TUF: %w", err)`
`118`	`117`	`}`
`119`		`- ko.SigningConfig = signingConfig`
`120`	`118`	`} else if o.SigningConfigPath != "" {`
`121`		`- signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)`
	`119`	`+ ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)`
`122`	`120`	`if err != nil {`
`123`	`121`	`return fmt.Errorf("error reading signing config from file: %w", err)`
`124`	`122`	`}`
`125`		`- ko.SigningConfig = signingConfig`
`126`	`123`	`}`
`127`	`124`
`128`	`125`	`v := attest.AttestBlobCommand{`
Original file line number	Diff line number	Diff line change
`@@ -124,6 +124,8 @@ func (o AttestOptions) AddFlags(cmd cobra.Command) {`
`124`	`124`	`cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",`
`125`	`125`	`"path to a signing config file. Must provide --new-bundle-format, which will store verification material in the new format")`
`126`	`126`
	`127`	`+ cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")`
	`128`	`+`
`127`	`129`	`cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",`
`128`	`130`	`"optional path to a TrustedRoot JSON file to verify a signature after signing")`
`129`	`131`	`}`
Original file line number	Diff line number	Diff line change
`@@ -152,6 +152,8 @@ func (o SignOptions) AddFlags(cmd cobra.Command) {`
`152`	`152`	`cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",`
`153`	`153`	`"path to a signing config file. Must provide --new-bundle-format, which will store verification material in the new format")`
`154`	`154`
	`155`	`+ cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")`
	`156`	`+`
`155`	`157`	`cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",`
`156`	`158`	`"optional path to a TrustedRoot JSON file to verify a signature after signing")`
`157`	`159`	`}`
Original file line number	Diff line number	Diff line change
`@@ -143,29 +143,26 @@ race conditions or (worse) malicious tampering.`
`143`	`143`	`return fmt.Errorf("loading trusted root: %w", err)`
`144`	`144`	`}`
`145`	`145`	`} else {`
`146`		`- trustedMaterial, err := cosign.TrustedRoot()`
	`146`	`+ ko.TrustedMaterial, err = cosign.TrustedRoot()`
`147`	`147`	`if err != nil {`
`148`	`148`	`ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)`
`149`	`149`	`}`
`150`		`- ko.TrustedMaterial = trustedMaterial`
`151`	`150`	`}`
`152`	`151`	`}`
`153`	`152`
`154`	`153`	`if (o.UseSigningConfig \|\| o.SigningConfigPath != "") && !o.NewBundleFormat {`
`155`	`154`	`return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")`
`156`	`155`	`}`
`157`	`156`	`if o.UseSigningConfig {`
`158`		`- signingConfig, err := cosign.SigningConfig()`
	`157`	`+ ko.SigningConfig, err = cosign.SigningConfig()`
`159`	`158`	`if err != nil {`
`160`	`159`	`return fmt.Errorf("error getting signing config from TUF: %w", err)`
`161`	`160`	`}`
`162`		`- ko.SigningConfig = signingConfig`
`163`	`161`	`} else if o.SigningConfigPath != "" {`
`164`		`- signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)`
	`162`	`+ ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)`
`165`	`163`	`if err != nil {`
`166`	`164`	`return fmt.Errorf("error reading signing config from file: %w", err)`
`167`	`165`	`}`
`168`		`- ko.SigningConfig = signingConfig`
`169`	`166`	`}`
`170`	`167`
`171`	`168`	`if err := sign.SignCmd(ro, ko, *o, args); err != nil {`
Original file line number	Diff line number	Diff line change
`@@ -111,28 +111,25 @@ func SignBlob() *cobra.Command {`
`111`	`111`	`return fmt.Errorf("loading trusted root: %w", err)`
`112`	`112`	`}`
`113`	`113`	`} else {`
`114`		`- trustedMaterial, err := cosign.TrustedRoot()`
	`114`	`+ ko.TrustedMaterial, err = cosign.TrustedRoot()`
`115`	`115`	`if err != nil {`
`116`	`116`	`ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)`
`117`	`117`	`}`
`118`		`- ko.TrustedMaterial = trustedMaterial`
`119`	`118`	`}`
`120`	`119`	`}`
`121`	`120`	`if (o.UseSigningConfig \|\| o.SigningConfigPath != "") && o.BundlePath == "" {`
`122`	`121`	`return fmt.Errorf("must provide --bundle with --signing-config or --use-signing-config")`
`123`	`122`	`}`
`124`	`123`	`if o.UseSigningConfig {`
`125`		`- signingConfig, err := cosign.SigningConfig()`
	`124`	`+ ko.SigningConfig, err = cosign.SigningConfig()`
`126`	`125`	`if err != nil {`
`127`	`126`	`return fmt.Errorf("error getting signing config from TUF: %w", err)`
`128`	`127`	`}`
`129`		`- ko.SigningConfig = signingConfig`
`130`	`128`	`} else if o.SigningConfigPath != "" {`
`131`		`- signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)`
	`129`	`+ ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)`
`132`	`130`	`if err != nil {`
`133`	`131`	`return fmt.Errorf("error reading signing config from file: %w", err)`
`134`	`132`	`}`
`135`		`- ko.SigningConfig = signingConfig`
`136`	`133`	`}`
`137`	`134`
`138`	`135`	`for _, blob := range args {`