[anithapriyanatarajan]

Changes

Fixes #2036

Root cause

With storage.oci.encoding-format: sigstore-bundle, Chains v0.29.0-v0.29.x wrote
image signatures that no verifier accepts. The bundle was a DSSE envelope around
a simplesigning payload signed over its raw bytes, and rekor.go logged it as
a hashedrekord entry. A DSSE bundle needs an in-toto payload, a signature over
the DSSE PAE and a dsse/intoto Rekor entry, so verification fails
(rekor v1 entry is not a dsse_v001 or intoto_v002 entry). Attestations were not
affected. cosign verify hid the failure whenever the SLSA attestation bundle was
also stored, because it passes if any bundle verifies.

Fix

The encoding mode decides the image-signature payload. There is no new config key.

• dsse: unchanged (simplesigning, raw-byte signature, hashedrekord, .sig tag).
• sigstore-bundle: new internal payload cosign-sign/v1, the same shape as
  cosign sign v3. It is an in-toto v1 Statement with the image repository and
  sha256 digest as subject, predicateType: https://sigstore.dev/cosign/sign/v1
  and predicate: {}.

It reuses the existing attestation path: wrapped DSSE signer, a dsse Rekor
entry, and AttestationStorer / WriteAttestationNewBundleFormat. The broken
SimpleStorer bundle path is removed, and SimpleStorer now returns an error in
sigstore-bundle mode. artifacts.oci.format is not used for payload selection in
that mode.

Decision pending maintainer confirmation

sigstore-bundle now requires artifacts.oci.storage to be oci only. The config
is rejected at load time otherwise (error references #2036), because grafeas, docdb,
gcs, pubsub and archivista expect a simplesigning payload for OCI images. Please
confirm this is the behavior you want. cosign-sign/v1 is also in
IntotoAttestationSet; the Grafeas backend is not changed and relies on this
config check.

Tests

• Payloader, OCIArtifact.PayloadFormat in both modes, config validation
  (oci accepted; oci,grafeas and others rejected; dsse unaffected), and
  ObjectSigner payload format / wrapping / Rekor format per encoding.
• In-process crypto test (pkg/chains/storage/oci/cosignsign_bundle_test.go):
  signs with the real wrapped DSSE signer, stores to an in-memory registry with
  referrers support, and verifies the referrer's bundle with sigstore-go
  (WithArtifactDigest + WithKey). It also asserts the dsseEnvelope content,
  payload type and referrer annotations, and that a tampered payload or a wrong
  digest fails. With a Rekor entry, tlogEntries[0].kindVersion.kind == "dsse".
• Regression: dsse mode still writes a .sig tag with a simplesigning layer.
• e2e (test/oci_sigstore_bundle_e2e_test.go): cosign v3 verify (and
  verify-attestation --type slsaprovenance) for signature only and
  signature + attestation, with transparency on and off. It asserts a
  cosign/sign/v1 entry is present in the output, since exit code 0 alone can be
  satisfied by the attestation.

e2e notes

• Vendored cosign v2.6.x referrerManifest.targetRef drops name.Insecure, so the
  referrer manifest write to a plain-HTTP registry reached by a DNS name uses HTTPS.
  The e2e registry is therefore addressed by its Service ClusterIP; go-containerregistry
  treats private IPs as HTTP. This is a test-only workaround. Production use with a
  plain-HTTP registry by DNS name is still affected.
• The e2e tests have not been run yet. The cosign image tag
  (ghcr.io/sigstore/cosign/cosign:v3.1.4-dev) and its shell path are unverified.
  The verify step uses the public key from the signing secret rather than
  k8s://tekton-chains/signing-secrets.
• sigstore-go is now a direct dependency in go.mod (already vendored, no vendor diff).

Sample bundle written by the unit test

cosign download signature style output for an image signature in sigstore-bundle mode:

{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json",
 "verificationMaterial":{"publicKey":{"hint":"ICAGuSNlLNbuhnueYznCFLTHYzGgjGfTuTMBIogfxVk="}},
 "dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCAic3ViamVjdCI6W3sibmFtZSI6IjEyNy4wLjAuMTozNjEwNy90ZXN0L2Nvc2lnbi1zaWduLWltZyIsICJkaWdlc3QiOnsic2hhMjU2IjoiNjEzNTQ5YjlhOGNmNzY5MDNkMmJiYTNiNjIxMjBkZjg0NmI4ZGRjODgzZDM0MTA2NjQyN2NmYjczMDE1MTZiNSJ9fV0sICJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zaWdzdG9yZS5kZXYvY29zaWduL3NpZ24vdjEiLCAicHJlZGljYXRlIjp7fX0=",
  "payloadType":"application/vnd.in-toto+json",
  "signatures":[{"sig":"MEUCIE2vGJ4xeqnxLVV5hBcyu6FBT2O5Y07frWRs7gG2hEpRAiEA6P17QCUZ5rT3TAE1r2+w7n+hFezKejoL2La9uqdrknU="}]}}

The decoded payload is:

{"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"127.0.0.1:36107/test/cosign-sign-img","digest":{"sha256":"613549b9a8cf76903d2bba3b62120df846b8ddc883d341066427cfb7301516b5"}}],"predicateType":"https://sigstore.dev/cosign/sign/v1","predicate":{}}

Out of scope

KMS no-verification-material guard, insecureNameOpts, Microshift assignSCC
(salvaged from #2044), Rekor v2 / TSA support, upstream cosign changes.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs included if any changes are user facing
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Bug fix: image signatures written with `storage.oci.encoding-format: sigstore-bundle` are now verifiable with cosign v3. They are in-toto `cosign/sign/v1` statements signed as DSSE, matching `cosign sign`.
Signatures written by v0.29.0-v0.29.x in that mode remain unverifiable; re-sign or rebuild the affected images.
action required: `sigstore-bundle` now requires `artifacts.oci.storage` to be `oci` only. Chains rejects the configuration at load time if it includes another backend (grafeas, docdb, gcs, pubsub, archivista, ...).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.11%. Comparing base (bca40a9) to head (14c39e4).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2096      +/-   ##
==========================================
+ Coverage   79.60%   80.11%   +0.50%     
==========================================
  Files          58       59       +1     
  Lines        3384     3349      -35     
==========================================
- Hits         2694     2683      -11     
+ Misses        688      664      -24     
  Partials        2        2              

Flag	Coverage Δ
unit-tests	80.11% <ø> (+0.50%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[anithapriyanatarajan]

@tektoncd/chains-collaborators - Request your detailed review and feedback on this PR. Thank you.

[anithapriyanatarajan]

Detailed manual test notes:
Chains-PR2096-Test-Runbook.pdf

[Copilot]

🟡 Changes recommended

The documentation still claims the setting has no effect with non-OCI artifact backends, but enabling OCI image signing with sigstore-bundle now rejects such configurations.

1 open issue

• Update outdated note about sigstore-bundle configuration failures · New

What changed in this PR

Fixes #2036 by routing OCI image signatures in sigstore-bundle mode through Chains’ existing DSSE attestation path, producing cosign/sign/v1 statements instead of unverifiable SimpleSigning bundles.

Changes:

• Adds an encoding-dependent image-signature format while preserving legacy dsse behavior.
• Rejects non-OCI storage backends for enabled OCI image signing in bundle mode and documents the restriction.
• Adds cryptographic verification, regression, and cosign v3 end-to-end tests; the end-to-end tests remain unrun.

File	Description
test/​oci_sigstore_bundle_e2e_test.go	Adds cosign v3 verification scenarios with transparency on and off.
test/​clients.go	Adds ClusterIP-based registry addressing for bundle tests.
pkg/​config/​config.go	Validates OCI image storage backends in bundle mode.
pkg/​config/​config_test.go	Tests backend restrictions and disabled-signing exceptions.
pkg/​chains/​storage/​oci/​simple.go	Removes invalid bundle creation and rejects bundle-mode requests.
pkg/​chains/​storage/​oci/​simple_test.go	Tests legacy signature tags and bundle-mode rejection.
pkg/​chains/​storage/​oci/​cosignsign_bundle_test.go	Adds bundle verification, tampering, and Rekor-entry checks.
pkg/​chains/​signing_test.go	Tests payload selection, DSSE wrapping, and Rekor format routing.
pkg/​chains/​formats/​format.go	Classifies the new payload as an in-toto attestation.
pkg/​chains/​formats/​cosignsign/​cosignsign.go	Implements the cosign/sign/v1 statement formatter.
pkg/​chains/​formats/​cosignsign/​cosignsign_test.go	Tests statement content and formatter behavior.
pkg/​chains/​formats/​all/​all.go	Registers the new formatter.
pkg/​artifacts/​signable.go	Selects the image payload format by encoding mode.
pkg/​artifacts/​signable_test.go	Tests encoding-dependent payload selection.
go.mod	Promotes sigstore-go to a direct dependency.
docs/​oci-encoding-format.md	Explains corrected bundle contents, restrictions, and verification.
docs/​config.md	Documents payload selection and backend restrictions.
config/​100-deployment.yaml	Updates configuration comments with the backend restriction.

_{Review effort: Balanced}

[infernus01]

@anithapriyanatarajan This is a valid review.

[infernus01]

Thanks for the PR @anithapriyanatarajan. I did a thorough testing and found payloadType is "application/vnd.in-toto+json" and cosign verification also works:

[{"critical":{"identity":{"docker-reference":"10.96.202.200:5000/final-test@sha256:4741f679c26d8f59e42c3fad6768efc7855b006d283c7cfd35a7271be455f1d4"},"image":{"dock
er-manifest-digest":"sha256:4741f679c26d8f59e42c3fad6768efc7855b006d283c7cfd35a7271be455f1d4"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":{}}]

Verification for 10.96.202.200:5000/final-test@sha256:4741f679c26d8f59e42c3fad6768efc7855b006d283c7cfd35a7271be455f1d4 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The signatures were verified against the specified public key

/lgtm

[infernus01]

/retest

[infernus01]

/retest

[infernus01]

/kind bug

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: infernus01

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [infernus01]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

/lgtm