pkg/oci imported pkg/cosign/bundle only for RekorBundle,
RekorPayload, RFC3161Timestamp and BundleV03MediaType. That package
also contains SignData, which imports sigstore-go's sign and root
packages, so every consumer of pkg/oci linked the signing stack.
Move these types and the media type constant into the new leaf
package pkg/cosign/bundle/types and import that from pkg/oci.
pkg/cosign/bundle keeps type aliases, so its API is unchanged.
The base pkg/oci package goes from 86 to 2 transitive modules. For
ko, which uses pkg/oci, pkg/oci/mutate, pkg/oci/walk and
pkg/oci/remote, the binary goes from 161 to 146 modules.
Signed-off-by: Manuel Rüger <manuel@rueg.eu>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
0433f847df