COSIGN_OCI_EXPERIMENTAL still uses old cosign tag

[itaysk]

I'm playing around with cosign with the latest OCI 1.1 with Referrers support. For the test I'm running a local zot registry.
It keeps using the old cosign tag instead of the new OCI tag (or no tag in case of zot?)

COSIGN_OCI_EXPERIMENTAL=1 cosign sign $myimage
...
tlog entry created with index: 16776742
Pushing signature to: localhost:5001/zot

regctl tag list $myimage
latest
sha256-501e08f696ad6fb26680a6f0d3f0471a40da05f20fc64654118c3474c4a64c70.sig

COSIGN_OCI_EXPERIMENTAL=1 cosign attach sbom --sbom ./spdx.json --type spdx $myimage
...
Uploading SBOM file for [localhost:5001/zot:latest] to [localhost:5001/zot:sha256-501e08f696ad6fb26680a6f0d3f0471a40da05f20fc64654118c3474c4a64c70.sbom] with mediaType [text/spdx+json].

regctl tag list $myimage
latest
sha256-501e08f696ad6fb26680a6f0d3f0471a40da05f20fc64654118c3474c4a64c70.sbom

I've also tried to export COSIGN_OCI_EXPERIMENTAL=1 just in case.

cosign version                                                
  ______   ______        _______. __    _______ .__   __.
 /      | /  __  \      /       ||  |  /  _____||  \ |  |
|  ,----'|  |  |  |    |   (----`|  | |  |  __  |   \|  |
|  |     |  |  |  |     \   \    |  | |  | |_ | |  . `  |
|  `----.|  `--'  | .----)   |   |  | |  |__| | |  |\   |
 \______| \______/  |_______/    |__|  \______| |__| \__|
cosign: A tool for Container Signing, Verification and Storage in an OCI registry.

GitVersion:    v2.0.0
GitCommit:     d6b9001f8e6ed745fb845849d623274c897d55f2
GitTreeState:  clean
BuildDate:     2023-02-23T19:26:35Z
GoVersion:     go1.20.1
Compiler:      gc
Platform:      darwin/amd64

Any tips?

[znewman01]

CC @jdolitsky; see #2684

I think you need to use --registry-referrers-mode oci-1-1. This will get less awkward over time, promise 🙂

[jdolitsky]

Hey Itay!

I think you need to use --registry-referrers-mode oci-1-1

Yes, thats it.

Wrote a bit more about this here: https://www.chainguard.dev/unchained/building-towards-oci-v1-1-support-in-cosign

[itaysk]

Hi Josh! 🤗

Thanks both. works great