cli: deprecate verify --cert

[woodruffw]

The long form (--certificate) is the intended option.

Closes #149.

Signed-off-by: William Woodruff william@trailofbits.com

[woodruffw]

As a demo:

$ sigstore verify --cert README.md.crt README.md
WARNING:sigstore._cli:--cert has been replaced with --certificate and will be removed in an upcoming stable release

[tetsuo-cpp]

Does cosign still use --cert? I had a quick grep and it looks like it still does.

I'll leave the judgement call to you but I tend to think that it's more important that our CLI is compatible with cosign than to be symmetrical or consistent in general.

[woodruffw]

I'll leave the judgement call to you but I tend to think that it's more important that our CLI is compatible with cosign than to be symmetrical or consistent in general.

Yeah, that's why I wanted to get @di's opinion -- IMO we're divergent enough at this point that it makes sense to make changes that improve our UX, but this is admittedly a very small example of one of those changes 🙂

[di]

I think we should just support both as the same option for now, with no deprecation warning, to ensure this remains intuitive for cosign users as well as make sense for new users.

[woodruffw]

Sounds good. I'll mark this as a draft then, and we can revisit if necessary.