Return Public key in sign-blob when no certificate can be extracted.

[tommyd450]

Summary

My attempt to address #4140 . I have added a fallback for certificate output in cosign sign blob, similar to sign it outputs the public key used if no certificate is present.

Release Note

• When using sign-blob with cert output will now output encoded public key if no cert can be extracted.

Documentation

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 35.06%. Comparing base (2ef6022) to head (3c2ea03).
⚠️ Report is 492 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/sign/sign.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4224      +/-   ##
==========================================
- Coverage   40.10%   35.06%   -5.04%     
==========================================
  Files         155      214      +59     
  Lines       10044    14576    +4532     
==========================================
+ Hits         4028     5111    +1083     
- Misses       5530     8811    +3281     
- Partials      486      654     +168     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[haydentherapper]

Thanks for looking into fixing this!

I wasn't clear in the issue, the fix is actually the inverse of this - we should not print a public key with --output-certificate in cosign sign. The behavior of cosign sign-blob is working as intended.

In cosign sign here, I'd suggest checking if the signer is a certificate before writing it to disk, otherwise do nothing.