Skip to content

cosign sign record-creation-timestamp=true not taken into account for new bundle format #4465

@baal-lgln

Description

@baal-lgln

Description

Since v3 the record-creation-timestamp=true parameter for the cosign sign command is no longer taken into account in our IBM Container registry for the new bundle format and no date is added to the OCI manifest in our registry.

The problem is that we have rules inside this registry to delete "old" manifests and manifests without dates are recognized as old manifests.
The same problem is described in detail here:

These screenshots show how the old format is correctly shown with da date (created with the workaround --new-bundle-format=false --use-signing-config=false) and the new bundle format is without a date:

Image Image

Is there any way to add a date without using the workaround --new-bundle-format=false --use-signing-config=false?

Version
cosign v3.0.2

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions