passing '--bundle' flag causes cosign to ignore '--output-certificate' and '--output-signature'

[patflynn]

Good news is this behavior is the same in keyless and keyfull mode.

to reproduce:

1. run COSIGN_EXPERIMENTAL=true cosign sign-blob java-service.jar --output-certificate foo.pem --output-signature foo.sig --bundle foo.bundle

2. run $ ls and observe that your foo.sig and foo.pem files were never written.

[znewman01]

Duplicate of #1821

[Dentrax]

I think @priyawadhwa did this on purpose, since foo.bundle contains both of sig and cert information inside it:

# same output as --output-signature
$ cat foo.bundle | jq -r .base64Signature

# same output as --output-certificate
$ cat foo.bundle | jq -r .cert

What's the right UX here?

• if --bundle passed with any other --output- flag, should we print an info log about we ignore other outputs?
• rename --bundle to --output-bundle and do not ignore the rest
• make --bundle mutually exclusive with --output- flags

[priyawadhwa]

Just commented in #1821 as well, but I think this is a bug. --bundle should work independently & --output-signature and --output-certificate should be respected!