Support v2s2 manifests in sigstore attachments (for cosign compatibility)

[itroyano]

Issue Description

A signed image that got successfully pushed to Artifactory, using https://github.com/sigstore/cosign#registry-support, cannot be pulled due to an error:

Error: Source image rejected: unexpected MIME type for sigstore attachment manifests .... "application/vnd.docker.distribution.manifest.v2+json"

Issue seems to be https://github.com/containers/image/blob/main/docker/docker_client.go#L1043 expects only OCI.

Steps to reproduce the issue (using Podman or Docker client)

1. Sign and push an image using COSIGN_DOCKER_MEDIA_TYPES=1 cosign sign .... to Artifactory, as described in https://github.com/sigstore/cosign#registry-support

2. Try to pull the image

Actual result

Error: Source image rejected: unexpected MIME type for sigstore attachment manifests .... "application/vnd.docker.distribution.manifest.v2+json"

Expected result

Image pulled successfully.

Additional environment details

Cosign v1.13.1

Also tried with v2.1.1.

[mtrmac]

Thanks for your report. Yes, that’s not currently implemented.