Problem
retagger sign verifies a digest before signing it and signed whenever the verify failed. cosign v3 verify detects the bundle format with a referrers listing and, when that listing fails for any reason — the registry throttling the per-identity ListReferrers lookups of a busy pass — falls back silently to the legacy signature-tag path and reports no signatures found, the same text and exit code as for a digest that was never signed. A sign-all pass with four workers trips the throttle about every 80 s, and the four in-flight pre-checks then re-signed their digests: a duplicate signature and Rekor entry each, ~40–55 per large file per pass, harmless and invisible in the log.
Solution
#1239. The pre-check logs the verify's error at debug level with cosign's message; trusts no signatures found only once the registry's referrers list confirms no signature bundle for the digest (a listed bundle means the lookup was throttled, and the verify is retried with backoff); signs over another identity's signature; and fails the tag for any other verify error instead of signing blindly. The registry's throttling of the listing is retried like any transient error, as is the TUF cache race between concurrent cosign processes.
Acceptance criteria
Problem
retagger signverifies a digest before signing it and signed whenever the verify failed. cosign v3verifydetects the bundle format with a referrers listing and, when that listing fails for any reason — the registry throttling the per-identityListReferrerslookups of a busy pass — falls back silently to the legacy signature-tag path and reportsno signatures found, the same text and exit code as for a digest that was never signed. Asign-allpass with four workers trips the throttle about every 80 s, and the four in-flight pre-checks then re-signed their digests: a duplicate signature and Rekor entry each, ~40–55 per large file per pass, harmless and invisible in the log.Solution
#1239. The pre-check logs the verify's error at debug level with cosign's message; trusts
no signatures foundonly once the registry's referrers list confirms no signature bundle for the digest (a listed bundle means the lookup was throttled, and the verify is retried with backoff); signs over another identity's signature; and fails the tag for any other verify error instead of signing blindly. The registry's throttling of the listing is retried like any transient error, as is the TUF cache race between concurrent cosign processes.Acceptance criteria
sign-allpass right after a completed one reports0 signedfor tags whose digest did not change (only mutable names such aslatestmay re-sign) — pipeline 6424, all eleven gsoci jobs0 signed, 0 failed(evidence).