cosign sign-blob fails with time stamping authority after upgrade to 3.0.2

[augjoh]

Description

After upgrading cosign to latest version, signing blobs fails with a strange error message:

$ cosign sign-blob acme-client.SHA256 --bundle acme-client.bundle --timestamp-server-url http://freetsa.org/tsr --rfc3161-timestamp acme-client.tsr
Error: cannot specify service URLs and use signing config
error during command execution: cannot specify service URLs and use signing config

There is no configuration file involved.

Version

3.0.2

[haydentherapper]

This is working as intended. We've transitioned over to using a configuration file for specifying services.

You can either specify --use-signing-config=false, or copy the linked file and replace the first tsaURLs instance with http://freetsa.org/tsr.