Summary

Add bounded exponential-backoff retry around sign.Bundle in the
AICR-side Sigstore signing wrapper, and wrap goreleaser's
cosign attest-blob post-hook in a bash 3-attempt retry loop with
exponential backoff. Absorbs transient Sigstore Rekor flakes
that have been turning ordinary upstream latency into CI failures.

Fixes: #1249
Refs: #1244 (first observed instance), #1245 (second; in review)

Type of Change

• Bug fix (transient-flake mitigation)

Component(s) Affected

• pkg/bundler/attestation — retry wrapper
• pkg/defaults — new retry-budget constants + invariant test
• .goreleaser.yaml — cosign CLI retry flag

Implementation Notes

Failure being absorbed

Two PRs hit identical traces within 24h:

[TIMEOUT] sigstore signing timed out:
  Post "https://rekor.sigstore.dev/api/v1/log/entries":
  giving up after 1 attempt(s): context deadline exceeded

The 1 attempt(s) came from pkg/bundler/attestation/signing.go's
single-pass sign.Bundle() invocation. The wrapper had no retry, so
slow Rekor responses on the only attempt produced terminal failure.

Constants (pkg/defaults/timeouts.go)

Worst-case wall-clock: 3 × 35s + 1s + 5s = 111s — fits inside the
existing SigstoreSignTimeout = 2m ceiling.
TestSigstoreRetryBudgetInvariant guards the math against future
tuning that would overflow.

Retry semantics (signWithRetry helper)

Extracted the sign.Bundle invocation into a helper that wraps any
sign-attempt closure with bounded exponential-backoff retry:

Backoff sleep is interruptible by the outer ctx — a Rekor recovering
10s later doesn't waste the remaining budget. The retry treats
transient failures uniformly without trying to parse error text or
HTTP status (which would be brittle); the bounded retry budget caps
the wasted time on a permanent failure (e.g., expired OIDC token) at
~111s.

.goreleaser.yaml

cosign attest-blob is now wrapped in a bash 3-attempt retry loop
with 5s / 10s backoffs. First attempt of this PR tried
cosign attest-blob --retry 5 — that flag does not exist on cosign
v3.0.2 (Rekor retry behavior is internal to the rekor-go client and
not exposed via the cosign CLI), so the first CI run failed with
Error: unknown flag: --retry. Shell-level retry loop is the
equivalent mitigation for the binary-attestation step; the AICR-side
signWithRetry covers the catalog-signing step on the same
post-build hook chain.

Docs

pkg/bundler/attestation/doc.go gains a "Retry Contract" section
documenting the per-attempt / outer-ceiling split, the three
retry-class branches, and the invariant test pointer.

Testing

go test -race -count=1 ./pkg/defaults/ ./pkg/bundler/...
golangci-lint run -c .golangci.yaml ./pkg/defaults/... ./pkg/bundler/...

Five new retry tests in pkg/bundler/attestation/signing_retry_test.go:

Plus TestSigstoreRetryBudgetInvariant in pkg/defaults/.

All tests use t.Parallel(). Full-exhaustion test runs ~6s wall-clock
(real backoffs); others are sub-second.

Risk Assessment

• Low — isolated to one helper; existing single-pass behavior
  is the new "success on attempt 1" path; outer ceiling unchanged.

Rollout notes: No user-facing CLI/API behavior change. Healthy
Rekor paths see identical latency. Transient Rekor failures that
previously failed the run now succeed after a few seconds of
backoff (visible as slog.Warn lines naming attempt + backoff +
error). A permanent failure (e.g., expired OIDC token, Fulcio 4xx)
takes up to ~111s instead of failing fast — acceptable trade-off
since the error message is unchanged.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (changed paths)
• I did not skip/disable tests to make CI green
• I added new tests for the new functionality
• Docs updated (pkg/bundler/attestation/doc.go)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)