Recursively sign multi-arch image [CLOUDDST-24102]

emilyzheng · Oct 9, 2024 · c22b7f4 · c22b7f4
1 parent e01d4b1
commit c22b7f4
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/src/pubtools/sign/signers/cosignsigner.py b/src/pubtools/sign/signers/cosignsigner.py
@@ -255,6 +255,7 @@ def container_sign(self: CosignSigner, operation: ContainerSignOperation) -> Sig
             "--rekor-url",
             self.rekor_url,
             "--tlog-upload=%s" % ("true" if self.upload_tlog else "false"),
+            "-r",
         ]
         if self.registry_user:
             common_args += ["--registry-username", self.registry_user]

diff --git a/tests/test_cosign_signer.py b/tests/test_cosign_signer.py
@@ -95,6 +95,7 @@ def f_expected_cosign_sign_args():
         "--rekor-url",
         "https://rekor.sigstore.dev",
         "--tlog-upload=true",
+        "-r",
         "--registry-username",
         "some-user",
         "--registry-password",
@@ -122,6 +123,7 @@ def f_expected_cosign_sign_identity_args():
             "--rekor-url",
             "https://rekor.sigstore.dev",
             "--tlog-upload=true",
+            "-r",
             "--registry-username",
             "some-user",
             "--registry-password",
@@ -367,6 +369,7 @@ def test_container_sign_alias(f_config_cosign_signer_aliases, f_environ):
                         "--rekor-url",
                         "https://rekor.sigstore.dev",
                         "--tlog-upload=true",
+                        "-r",
                         "-a",
                         "tag=tag",
                         "some-registry/namespace/repo@sha256:abcdefg",
@@ -461,6 +464,7 @@ def test_container_sign_digests_only(
                         "--rekor-url",
                         "https://rekor.sigstore.dev",
                         "--tlog-upload=true",
+                        "-r",
                         "--registry-username",
                         "some-user",
                         "--registry-password",
@@ -520,6 +524,7 @@ def test_container_sign_digests_only_indentity(
                         "--rekor-url",
                         "https://rekor.sigstore.dev",
                         "--tlog-upload=true",
+                        "-r",
                         "--registry-username",
                         "some-user",
                         "--registry-password",