[JasonPowr]

NewBundleFormat is parsed from the CLI flag but never copied to KeyOpts in sign.go,
causing TSA signing to fail with:

"expected either new bundle or an rfc3161-timestamp path when using a TSA server"

This only affects the manual flags path (--use-signing-config=false with explicit
--timestamp-server-url). The default signing config path is unaffected as it sources
TSA and bundle format settings from the trusted root / signing config, bypassing KeyOpts.

Fix: add the missing NewBundleFormat: o.NewBundleFormat to the KeyOpts struct initialization.

Fixes: #4980

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 38.48%. Comparing base (2ef6022) to head (ceeaf83).
⚠️ Report is 790 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/sign.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4981      +/-   ##
==========================================
- Coverage   40.10%   38.48%   -1.62%     
==========================================
  Files         155      209      +54     
  Lines       10044    13007    +2963     
==========================================
+ Hits         4028     5006     +978     
- Misses       5530     7291    +1761     
- Partials      486      710     +224     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Hayden-IO]

Thanks!