From f849402339ee7a31089a52b047d160d2779d8f43 Mon Sep 17 00:00:00 2001
From: William Woodruff <william@trailofbits.com>
Date: Wed, 23 Oct 2024 14:06:49 -0400
Subject: [PATCH] _cli: don't warn on bare .sigstore if cert/sig is used
 (#1179)

---
 sigstore/_cli.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sigstore/_cli.py b/sigstore/_cli.py
index 554828961..88fff3a29 100644
--- a/sigstore/_cli.py
+++ b/sigstore/_cli.py
@@ -931,7 +931,14 @@ def _collect_verification_state(
             legacy_default_bundle = file.parent / f"{file.name}.sigstore"
             bundle = file.parent / f"{file.name}.sigstore.json"
 
-            if not bundle.is_file() and legacy_default_bundle.is_file():
+            if (
+                not bundle.is_file()
+                and legacy_default_bundle.is_file()
+                # NOTE(ww): Only show this warning if bare materials
+                # are not provided, since bare materials take precedence over
+                # a .sigstore bundle.
+                and not (cert or sig)
+            ):
                 _logger.warning(
                     f"{file}: {legacy_default_bundle} should be named {bundle}. "
                     "Support for discovering 'bare' .sigstore inputs will be deprecated in "