--timeout flag is not useful in verify* commands.

[zhaoyonghe]

Description

--timeout flag is not useful in verify* commands.

For example, when there is a network issue (not connecting to the company VPN but still try to access the internal service), even if I set --timeout 5s, the cosign verify will still hang for a long time (about one minute in my case) until erroring out.

$ ./cosign verify --timeout 5s internal.registry.com/image-name:tag
Error: Get "https://internal.registry.com/v2/": dial tcp <ip address>: i/o timeout
main.go:69: error during command execution: Get "https://internal.registry.com/v2/": dial tcp <ip address>: i/o timeout

Version

GitVersion:    v2.2.1-24-gda53b08c
GitCommit:     da53b08cb543117f817950fb915a57e3c421d3af
GitTreeState:  clean
BuildDate:     2023-11-27T17:23:19Z
GoVersion:     go1.21.1
Compiler:      gc
Platform:      darwin/arm64