Is there a way to establish no tampering on part of the container registry?

[gm42]

When signing a Docker image I usually follow these steps:

1. create the image
2. push it to the container registry
3. pull it again, so that digest will be correct when signing
4. sign the digest with cosign, which also pushes the signature artifact to the registry

The container registry could tamper with the image, for example adding a new layer, and thus the signing is pointless because I am not verifying that the digest I got when pulling again corresponds to what I previously built.

Is there a way to prevent this, for example by signing without pulling, or perhaps this is an non-problem because of the way cosign verifies authenticity of the image?

[haydentherapper]

I wouldn't say the signing is pointless, rather the signing is doing exactly what it should be - providing authenticity and integrity for the image. The registry can tamper with the image but the tampering becomes evident on verification. You need to verify that the container is signed using the identity or with the expected key, to prevent the registry (or any other malicious intermediary) from signing a malicious image with their own key. If either the identity/key is mismatched or signature verification fails, you know that the image was tampered with at some point and shouldn't be trusted.