refactor!: consistent function and feature names before 1.0

[wolfv]

This is a naming review across all published crates, done on top of #316 and #317. It covers Cargo features and public function names. It fixes the clear inconsistencies and lists judgment calls at the end.

Features

Feature names are already consistent. All crates use rustls and native-tls. client is the optional HTTP layer (rekor, tsa, and tuf after #317), tuf fetches trust roots (trust-root, sign, verify), and browser is in oidc and sign. One leak:

• trust-root: the tuf feature named its optional dependencies without dep:. That silently created public features called sigstore-tuf, tokio and directories, which we would have had to keep for all of 1.x. They now use dep:.

I checked cargo check for every published crate with no default features, with rustls only, with native-tls only, and with defaults. I also checked tuf, client and browser on their own. All of them build without warnings.

Renames

Crate	Before	After	Why
sign	SigningServices::embedded	from_embedded	Matches TrustedRoot::from_embedded and SigningContext::from_embedded
sign	SigningServices::from_tuf_config(_with_rekor_version)	from_signing_config(_with_rekor_version)	It takes a SigningConfig, not a TufConfig
oidc	OAuthClient::auth / auth_with_options	authenticate / authenticate_with_options	Matches SigningContext::authenticate
oidc	free get_identity_token(url)	authenticate(url)	It runs the interactive OAuth flow, which get_ hides
oidc	free parse_identity_token	removed	It duplicates IdentityToken::from_jwt
rekor	RekorV2Client::with_http_client(url, client)	RekorV2Client::builder(url).with_http_client(client).build()	Every other with_http_client takes self. This one was a static constructor. It now has a builder like RekorClient
bundle	TlogEntryBuilder::{log_index, integrated_time, inclusion_promise, inclusion_proof}	with_*	Every other builder in the workspace uses with_

Left as is, open for discussion

• get_* on network clients: Fulcio get_configuration, Rekor get_entry_by_uuid/get_checkpoint/get_tile, and TUF get_target(_info) are HTTP GETs, and they're named the same way across crates.
• VerificationPolicy::verify_tlog() and PublicKeyVerificationPolicy::verify_tlog(): these are bool getters, but the names read like actions. verifies_tlog() would be clearer. I didn't rename them here because refactor(verify)!: collapse verification entry points #316 touches the same code.
• Keyring::get_key / get_key_at / get_key_started_by (crypto): these are local lookups, so Rust's getter convention would name them key / key_at / key_started_by.
• sha384() (crypto): returns Vec<u8>, while sha256() and sha512() return typed hashes. There's no Sha384Hash type yet.
• HTTP client configuration: Fulcio, Rekor and TSA use a builder. OAuthClient, HttpRepository, TufConfig and SigningContext take with_http_client(self, ..) on the type itself. Each pattern is consistent within its crate, and both are common in Rust.

Testing

• The workspace tests pass (646). clippy --workspace --all-targets --all-features -D warnings and rustdoc with -D warnings are clean.
• The feature matrix above builds.
• This branch merges cleanly with refactor(verify)!: collapse verification entry points #316 and refactor(tuf)!: stabilize the sigstore-tuf API for 1.0 #317, and the combined state compiles with clippy clean.

Signed-off-by: Wolf Vollprecht w.vollprecht@gmail.com

🤖 Generated with Claude Code

[jku]

looks good

[jku]

• get_* on network clients: Fulcio get_configuration, Rekor get_entry_by_uuid/get_checkpoint/get_tile, and TUF get_target(_info) are HTTP GETs, and they're named the same way across crates.
• VerificationPolicy::verify_tlog() and PublicKeyVerificationPolicy::verify_tlog(): these are bool getters, but the names read like actions. verifies_tlog() would be clearer. I didn't rename them here because refactor(verify)!: collapse verification entry points #316 touches the same code.
• Keyring::get_key / get_key_at / get_key_started_by (crypto): these are local lookups, so Rust's getter convention would name them key / key_at / key_started_by.
• sha384() (crypto): returns Vec<u8>, while sha256() and sha512() return typed hashes. There's no Sha384Hash type yet.
• HTTP client configuration: Fulcio, Rekor and TSA use a builder. OAuthClient, HttpRepository, TufConfig and SigningContext take with_http_client(self, ..) on the type itself. Each pattern is consistent within its crate, and both are common in Rust.

no strong opinions on any of these, nothing seems that important