Description

We are using a cosign container inside our pipeline to sign newly build images.
Up until v2.1.1 (public.ecr.aws/bitnami/cosign:2.1.1) this works without problems:
cosign sign --yes --key cosign.key {{image}}@sha256:{{digest}}
That creates a new OCI entry inside our IBM Container Registry:

{
  "Id": "sha256:[...]",
  "Parent": "",
  "Comment": "",
  "Created": "2023-10-12T14:52:17.989015938Z",
[...]
  "Size": 251,
  "VirtualSize": 251,
  "RootFS": {
    "Type": "layers",
    "Layers": [
      "sha256:[...]"
    ]
  },
  "ManifestType": "application/vnd.oci.image.manifest.v1+json"
}

After updating to v2.2.0 (public.ecr.aws/bitnami/cosign:2.2.0) the Created timestamp is totally wrong and leads to this:

{
  "Id": "sha256:[...]",
  "Parent": "",
  "Comment": "",
  "Created": "0001-01-01T00:00:00Z",
 [...]
  "Size": 251,
  "VirtualSize": 251,
  "RootFS": {
    "Type": "layers",
    "Layers": [
      "sha256:[...]"
    ]
  },
  "ManifestType": "application/vnd.oci.image.manifest.v1+json"
}

As we have some rules to delete older entries inside our registry these signatures are deleted soon after creation.
Image can be verified with cosign verify in both cases. The output does not differ.
This can be reproduced with different images.

Version

public.ecr.aws/bitnami/cosign:2.2.0