sign: Make SigningResult._to_bundle() public

This enables signing applications to use the bundle format and seems in
line with the other similar decisions:
* The bundle is already part of the CLI interface
* verify already contains similar public API
  (VerificationMaterials.from_bundle() is public)

Closes #763

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

sigstore/_cli.py

@@ -720,7 +720,7 @@ def _sign(args: argparse.Namespace) -> None:
 
             if outputs["bundle"] is not None:
                 with outputs["bundle"].open(mode="w") as io:
-                    print(result._to_bundle().to_json(), file=io)
+                    print(result.to_bundle().to_json(), file=io)
                 print(f"Sigstore bundle written to {outputs['bundle']}")
 
 

sigstore/sign.py

@@ -318,7 +318,7 @@ class SigningResult(BaseModel):
     A record of the Rekor log entry for the signing operation.
     """
 
-    def _to_bundle(self) -> Bundle:
+    def to_bundle(self) -> Bundle:
         """
         Creates a Sigstore bundle (as defined by Sigstore's protobuf specs)
         from this `SigningResult`.