Skip to content

Support multiple --sign-container-identity for cosign sign #4330

@emilyzheng

Description

@emilyzheng

Description

If an image can be pulled from multiple references (more than one image proxy or tag), cosign sign has to be run multiple times to include all of them:

cosign sign --sign-container-identity registry1/repo:tag1 <IMAGE DIGEST>
cosign sign --sign-container-identity registry1/repo:tag2 <IMAGE DIGEST>
cosign sign --sign-container-identity registry2/repo:tag1 <IMAGE DIGEST>
cosign sign --sign-container-identity registry2/repo:tag2 <IMAGE DIGEST>

Can cosign sign support multiple container identities so that the command only needs to be run once?

cosign sign --sign-container-identity registry1/repo:tag1 --sign-container-identity registry1/repo:tag2 --sign-container-identity registry2/repo:tag1 --sign-container-identity registry2/repo:tag2 <IMAGE DIGEST>

It would reduce write operations to the same signature and make signing more efficiently in this case.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions