skip signing/sbom if already present

Signed-off-by: Appu Goundan <appu@google.com>

Author: loosebazooka

private/oci/sign_and_push.bzl

@@ -11,8 +11,18 @@ tag="$(stamp "{TAG}")"
 digest="$(cat {DIGEST})"
 echo "Pushing $repository@$digest"
 {CRANE} push {IMAGE} "$repository@$digest"
-{COSIGN} attest "$repository@$digest" --predicate "{SBOM}" --type "spdx" --yes
-{COSIGN} sign "$repository@$digest" --yes
+
+# Check for signature and skip signing/sbom if present
+exit_code=0
+{COSIGN} verify "$repository@$digest" --certificate-oidc-issuer https://accounts.google.com --certificate-identity "${{KEYLESS}}" > /dev/null || exit_code=$?
+
+# We can't differentiate between system errors and cosign verification errors using exit code, so try on all
+# failures
+if [ $exit_code -ne 0 ]; then
+    {COSIGN} attest "$repository@$digest" --predicate "{SBOM}" --type "spdx" --yes
+    {COSIGN} sign "$repository@$digest" --yes
+fi
+
 {CRANE} tag "$repository@$digest" "$tag"
 """