Fix --sig-only in cosign copy (#3074)

This sigOnly early return needs to come after we Wait() for the
signature to finish copying.

Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>

cmd/cosign/cli/copy/copy.go

@@ -96,6 +96,7 @@ func CopyCmd(ctx context.Context, regOpts options.RegistryOptions, srcImg, dstIm
 		if err := copyTag(ociremote.SignatureTag); err != nil {
 			return err
 		}
+
 		if sigOnly {
 			return nil
 		}
@@ -117,15 +118,17 @@ func CopyCmd(ctx context.Context, regOpts options.RegistryOptions, srcImg, dstIm
 	}); err != nil {
 		return err
 	}
-	if sigOnly {
-		return nil
-	}
 
 	// Wait for everything to be copied over.
 	if err := g.Wait(); err != nil {
 		return err
 	}
 
+	// If we're only copying sigs, we have nothing left to do.
+	if sigOnly {
+		return nil
+	}
+
 	// Now that everything has been copied over, update the tag.
 	h, err := root.Digest()
 	if err != nil {