cosign attest --replace fails to create attestations on random.Image() generated images

[bburky]

While implementing the unit test for #1366, I discovered that cosign attest --replace silently fails to create any attestations on images created by go-containerregistry's random.Image(). That PR added a failing TestAttestationReplace() test which is currently skipped because the replace option doesn't create any attestations.

This can be reproduced outside the unit tests like this (using the v1.5.0 release binary):

>random.go <<EOF
package main

import (
	"context"
	"log"

	"github.com/google/go-containerregistry/pkg/authn"
	"github.com/google/go-containerregistry/pkg/name"
	"github.com/google/go-containerregistry/pkg/v1/random"
	"github.com/google/go-containerregistry/pkg/v1/remote"
)

func main() {
	n := "localhost:5000/x/y"

	ref, err := name.ParseReference(n, name.WeakValidation)
	if err != nil {
		log.Fatal(err)
	}
	img, err := random.Image(512, 5)
	if err != nil {
		log.Fatal(err)
	}

	regClientOpts := registryClientOpts(context.Background())

	if err := remote.Write(ref, img, regClientOpts...); err != nil {
		log.Fatal(err)
	}
}

func registryClientOpts(ctx context.Context) []remote.Option {
	return []remote.Option{
		remote.WithAuthFromKeychain(authn.DefaultKeychain),
		remote.WithContext(ctx),
	}
}
EOF
# Create an image localhost:5000/x/y using random.Image()
go run random.go
# The --replace option silently fails to create any attestations on images created by random.Image()
cosign attest --replace --predicate predicate.json localhost:5000/x/y --key cosign.key
# The following command shows no attestations exist
cosign download attestation "localhost:5000/x/y"

The cosign attest --replace option works fine on other images. I tested using images copied from Docker Hub using skopeo, and was able to create and replace attestations.