Sign without pulling from the registry

[sudo-bmitch]

This allows signing in a disconnected environment.

Signed-off-by: Brandon Mitchell git@bmitch.net

Summary

This skips registry queries when the reference provided includes the digest and it does not need to recursively resolve an Index or resolve the SBOM digest. The result is the ability to sign images in a disconnected environment without direct access to the registry, or to sign images before they are pushed to the registry (if the digest can be calculated in advance).

Ticket Link

This is handling issues similar to #596 when you know the digest (but doesn't handle situations when you don't know the digest).

Release Note

Do not query the registry when a digest is provided in the reference to sign.

[hectorj2f]

Great catch!

[sudo-bmitch]

Realizing that I missed some of the latest commits, working on rebasing now.

[dlorenc]

Welcome @sudo-bmitch! Great to have you here!

[dlorenc]

I think this is fine. If we end up switching to the Descriptor as a payload format we'll lose this ability because we still need to know the size, but we can deal with that later.

[sudo-bmitch]

Thanks @dlorenc. I'm looking to make the OCI Layout a first class format for images in tooling I work with. The full descriptor could then be pulled from the index.json. Then in CI pipelines with tools like in-toto and steps running without network access, the image could be passed around as a file or directory between various tools.

[dlorenc]

Thanks @dlorenc. I'm looking to make the OCI Layout a first class format for images in tooling I work with. The full descriptor could then be pulled from the index.json. Then in CI pipelines with tools like in-toto and steps running without network access, the image could be passed around as a file or directory between various tools.

Perfect! We're considering doing the same in thinks like Kaniko to better support hermetic builds!