Cosign architecture-specific images too? #484

Activity

1. dosubot

   added

   enhancementNew feature or requestNew feature or request

   on Aug 1, 2026
2. dosubot commented on Aug 1, 2026

   

   dosubotBot

   on Aug 1, 2026 – with DosuBot

   More actions

   Hi @pjonsson! I'm Dosu and I'm helping the CloudNativePG team.

   You're right — the --recursive flag is not currently used with cosign sign anywhere in this repository. The signing commands only sign the top-level manifest list by digest, not the individual architecture-specific images underneath it.

   There are two places where cosign sign is called:

   1. In the build workflow (bake_targets.yml):

      echo "${BUILD_METADATA}" | \
        jq '.[] | (."image.name" | sub(",.*";"" )) + "@" + ."containerimage.digest"' | \
        xargs cosign sign --yes

   2. In the image promotion action (copy-images/action.yml):

      cosign sign -t 5m --yes ${images}

   Neither uses --recursive. I didn't find any prior issues or PRs discussing recursive signing, so this appears to be a new request. Adding --recursive to these commands should sign all the architecture-specific images within the manifest list as well, which would resolve the Harbor content trust issue you're describing.

   To reply, just mention @dosu.

   ---

   Share context across your team and agents. Try Dosu.