Partially populate the output of cosign verify when working with new bundles

[steiza]

Summary

For #4372. Note that currently this only fills the the critical fields of the docker-reference, docker-manifest-digest, and type, and not any of the optional fields (which could be populated from sigstore-go verification results).

Release Note

• Updated cosign verify output when working with new bundles to include information about the verified container image

Documentation

N/A

[steiza]

As it stands, this pull request will return something like:

[{"critical":{"identity":{"docker-reference":"ghcr.io/steiza/nginx:latest"},"image":{"docker-manifest-digest":"sha256:2d5b42edd09430be531f850d10c43bfb50087b8afa81eb8d83df4ee02b2d3a4b"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":null}]

[codecov]

Codecov Report

❌ Patch coverage is 50.98039% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 34.26%. Comparing base (2ef6022) to head (d879c9e).
⚠️ Report is 530 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/verify/verify.go	50.98%	18 Missing and 7 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4416      +/-   ##
==========================================
- Coverage   40.10%   34.26%   -5.84%     
==========================================
  Files         155      218      +63     
  Lines       10044    15651    +5607     
==========================================
+ Hits         4028     5363    +1335     
- Misses       5530     9589    +4059     
- Partials      486      699     +213     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[steiza]

I should have known that #4316 was a little too easy! The content returned by VerifyImageAttestations() is very tailored to verify-attestations, and so when I reused that function for verify it didn't understand the JSON encoded information it was receiving.

I'm not a huge fan of this approach, but the alternative is pretty major surgery to pkg/cosign/verify.go, either making copy-pasting quite a bit of code to create a parallel codepath for verify, or refactoring the functions VerifyImageAttestations() calls to return much more information and then filter that down.

I think transforming the information we need in the cmd works for now, and when we simplify code paths to just use sigstore-go for verification it will be much easier to plumb the information we need back to the cmd, instead of transforming the information we receive today.

[haydentherapper]

Nice!