cosign verify-blob fails in experimental mode (keyless)

[cardil]

Description

The cosign verify-blob fails to verify a blob using keyless mode (in COSIGN_EXPERIMENTAL mode):

$ cosign verify-blob --verbose --key release-cosign.pub --signature cosign-linux-amd64.sig cosign-linux-amd64
Verified OK

$ COSIGN_EXPERIMENTAL=1 cosign verify-blob --verbose --signature cosign-linux-amd64.sig cosign-linux-amd64    
Error: verifying blob [cosign-linux-amd64]: failed to verify signature
main.go:46: error during command execution: verifying blob [cosign-linux-amd64]: failed to verify signature

Version

$ cosign version --json
{
  "GitVersion": "v1.5.1",
  "GitCommit": "c3e4d8b7cd2f6f065941510b260f173b70c695fa",
  "GitTreeState": "clean",
  "BuildDate": "'2022-01-30T20:05:28Z'",
  "GoVersion": "go1.17.6",
  "Compiler": "gc",
  "Platform": "linux/amd64"
}

[mattmoor]

Generally the .sig files for keyless and keyfull(?) signing will be different files, and you are passing the same .sig to both of these, which is likely the issue.

If you just sign with keyless, and then verify that signature, do you still see an issue?

[cardil]

Nice. It works for the -keyless.sig file:

$ COSIGN_EXPERIMENTAL=1 cosign verify-blob --verbose --signature cosign-linux-amd64-keyless.sig cosign-linux-amd64 
tlog entry verified with uuid: "30833cb58667ffc5949e7365fd22e0212b1d64fec94931d588bb22ba7fa42384" index: 1216646
Verified OK

However:

• The UI is bad, as cosign should inform the user that signature type is wrong, and keyless signature is required.
• Why the signature can't be the same file? It should be possible to have multiple signatures in a single sig file. Also, maybe it could be possible to the keyless, and keyfull to generate the same signature.

[znewman01]

Why the signature can't be the same file? It should be possible to have multiple signatures in a single sig file. Also, maybe it could be possible to the keyless, and keyfull to generate the same signature.

This is tracked here:
#2131

Leaving the issue open to make sure our error message is better here.