cosign attest uploads have artifactType: application/vnd.oci.empty.v1+json

[tongpu]

I'm currently trying to wrap my head around an issue I'm facing with a demo project where I'm attesting SBOM and Build Provenance using cosign attest. I plan to verify the attestation later on using a policy controller (e.g. Kyverno or Sigstore policy-controller and that's where I'm currently stuck and debugging what's wrong.

What I'm seeing is that the attestation I'm uploading via cosign attest to the GitLab Container Registry (e.g. registry.gitlab.com/tongpu/cosign-demo:sha256-578cded565e7c2167d0d589f0b274348bf3a15af8d06d7a287eb42e474185113) have "artifactType": "application/vnd.oci.empty.v1+json", while the ones I'm uploading to ghcr.io (e.g. ghcr.io/tongpu/cosign-demo:sha256-586546f1bdd1106a2c0286f6716ace50fe725b4776c6911f4c929394570affc3) via actions/attest have "artifactType": "application/vnd.dev.sigstore.bundle.v0.3+json".

Both work when running cosign verify-attestation with the respective option, but I somehow fail to configure working validation for Kyverno or Sigstore policy-controller and these differences are the only hints about potential issues I've found to far.

You can see the exact commands I'm executing in my .gitlab-ci.yml. I'm running cosign v3.0.6 from the Alpine repositories.