feat: Signing images by digest that don't exist yet

[paolomainardi]

Resolve #1905

Summary

This PR allows signing images before they are even existing on the OCI registry, as explained here #1905

To test it I've used this script:

❯ cat test-case/test.sh
#!/bin/sh
docker run -d -p 5001:5000 --restart=always --name cosign-registry registry:2 || true
docker build -t localhost:5001/cosign-nginx:1.0.0 test-case
docker push localhost:5001/cosign-nginx:1.0.0
docker image remove localhost:5001/cosign-nginx:1.0.0

DIGEST=$(crane digest localhost:5001/cosign-nginx:1.0.0)
docker rm -vf cosign-registry

# Try to push signed image.
echo "Trying to sign: ghcr.io/paolomainardi/cosign-1905-poc@$DIGEST"

./cosign sign ghcr.io/paolomainardi/cosign-1905-poc@${DIGEST}

# Now build and push the image.
docker build -t ghcr.io/paolomainardi/cosign-1905-poc:1.0.0 test-case
docker push ghcr.io/paolomainardi/cosign-1905-poc:1.0.0
REMOTE_DIGEST=$(crane digest ghcr.io/paolomainardi/cosign-1905-poc:1.0.0)
echo $REMOTE_DIGEST

Basically, I just used the local registry to take the digest to push to the remote registry and everything worked as expected.

I don't know too much in detail the signing process and the project, just tried the approach suggested here: #1905 (comment)

Release Note

Documentation

[codecov]

Codecov Report

Merging #2824 (c809523) into main (b69cade) will not change coverage.
The diff coverage is 0.00%.

@@           Coverage Diff           @@
##             main    #2824   +/-   ##
=======================================
  Coverage   29.54%   29.54%           
=======================================
  Files         151      151           
  Lines        9658     9658           
=======================================
  Hits         2853     2853           
  Misses       6366     6366           
  Partials      439      439           

Impacted Files	Coverage Δ
pkg/oci/remote/remote.go	36.91% <0.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[paolomainardi]

Just found this PR: https://github.com/sigstore/cosign/pull/2288/files (didn't check before) - this is another approach, I don't know if better or worse.

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR was closed because it has been stalled for 10 days with no activity.