Return verification

[indexzero]

Howdy all 👋 looking forward to contributing to the project. Many thanks to @wlynch and @hectorj2f for helping me ramp up on the codebases 🫶

Summary

Fixes #1489

This PR updates the behavior of verify to be consistent with the sigstore-go implementation. This result is returned to but not consumed by cosign so the corresponding packages/cli functionality was not updated as part of this PR to maximize cohesion

• Existing verify behavior: sigstore/sigstore-go/pkg/verify/signed_entity.go#798
• Existing cosign verify-blob behavior: sigstore/cosign/cmd/cosign/cli/verify/verify_blob.go#192

Release Note

• verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

n.b. the above was not marked as BREAKING as it – imho – technically a bug since it is a patch to match the existing sigstore-go implementation. I defer to the maintainers on that of course, but wanted to share the thought process 🙏

Documentation

Updated README.md to indicate the new return

Additional Remarks

🤖 claude helped here, but all of the packages/* code itself was 100% old fashioned fingers on keyboard. I don't use jest often so it was helpful in adding the test coverage for this change. No offense will be taken if it is updated or removed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2d7da9b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[hectorj2f]

LGTM

[hectorj2f]

friendly ping @bdehamer

[bdehamer]

@indexzero Thanks for contributing this change!

Everything looks great. My only request is that you also run npx changeset and commit the resulting changeset file (minor version bump to the sigstore package).

[indexzero]

@bdehamer roger that! I had put this down for the few weeks around JSConf, but will button it up this week for a final review & merge 🫶