feat(cli): add --payload-media-type to sign

arubegonsan · arubegonsan · commit 8850f72ddd68 · 2025-07-23T16:28:36.000Z
This commit introduces a new `--payload-media-type` flag to the
`cosign sign` command.

When signing with a custom payload using the `--payload` flag, users can
now also specify the MIME type of that payload via `--payload-media-type`.

This media type is then stored in the `mediaType` field of the signature
layer descriptor in the resulting OCI manifest. This allows consumers of
the signature to correctly interpret the payload's content type.

If `--payload` is not used, this flag is ignored.

Signed-off-by: Alberto Gonzalez &lt;albgonz@google.com&gt;
diff --git a/cmd/cosign/cli/attach/attach.go b/cmd/cosign/cli/attach/attach.go
@@ -89,8 +89,8 @@ func attachAttestation(ctx context.Context, remoteOpts []ociremote.Option, signe
 		// each access.
 		ref = digest // nolint
 
-		opts := []static.Option{static.WithLayerMediaType(types.DssePayloadType)}
-		att, err := static.NewAttestation(payload, opts...)
+		staticOpts := []static.StaticOption{static.WithLayerMediaType(types.DssePayloadType)}
+		att, err := static.NewAttestation(payload, staticOpts...)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/cosign/cli/attest/attest.go b/cmd/cosign/cli/attest/attest.go
@@ -170,9 +170,9 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
 		return nil
 	}
 
-	opts := []static.Option{static.WithLayerMediaType(types.DssePayloadType)}
+	staticOpts := []static.StaticOption{static.WithLayerMediaType(types.DssePayloadType)}
 	if sv.Cert != nil {
-		opts = append(opts, static.WithCertChain(sv.Cert, sv.Chain))
+		staticOpts = append(staticOpts, static.WithCertChain(sv.Cert, sv.Chain))
 	}
 	var timestampBytes []byte
 	var tsaPayload []byte
@@ -206,7 +206,7 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
 		}
 		bundle := cbundle.TimestampToRFC3161Timestamp(timestampBytes)
 
-		opts = append(opts, static.WithRFC3161Timestamp(bundle))
+		staticOpts = append(staticOpts, static.WithRFC3161Timestamp(bundle))
 	}
 
 	predicateType, err := options.ParsePredicateType(c.PredicateType)
@@ -218,7 +218,7 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
 		"predicateType": predicateType,
 	}
 	// Add predicateType as manifest annotation
-	opts = append(opts, static.WithAnnotations(predicateTypeAnnotation))
+	staticOpts = append(staticOpts, static.WithAnnotations(predicateTypeAnnotation))
 
 	// Check whether we should be uploading to the transparency log
 	shouldUpload, err := sign.ShouldUploadToTlog(ctx, c.KeyOpts, digest, c.TlogUpload)
@@ -238,10 +238,10 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
 		if err != nil {
 			return err
 		}
-		opts = append(opts, static.WithBundle(cbundle.EntryToBundle(rekorEntry)))
+		staticOpts = append(staticOpts, static.WithBundle(cbundle.EntryToBundle(rekorEntry)))
 	}
 
-	sig, err := static.NewAttestation(signedPayload, opts...)
+	sig, err := static.NewAttestation(signedPayload, staticOpts...)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/cosign/cli/options/sign.go b/cmd/cosign/cli/options/sign.go
@@ -30,6 +30,7 @@ type SignOptions struct {
 	OutputPayload           string
 	OutputCertificate       string
 	PayloadPath             string
+	PayloadMediaType        string
 	Recursive               bool
 	Attachment              string
 	SkipConfirmation        bool
@@ -96,6 +97,8 @@ func (o *SignOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&o.PayloadPath, "payload", "",
 		"path to a payload file to use rather than generating one")
 	// _ = cmd.MarkFlagFilename("payload") // no typical extensions
+	cmd.Flags().StringVar(&o.PayloadMediaType, "payload-media-type", "",
+		"media type of the payload. Ignored if --payload is not specified.")
 
 	cmd.Flags().BoolVarP(&o.Recursive, "recursive", "r", false,
 		"if a multi-arch image is specified, additionally sign each discrete image")
diff --git a/cmd/cosign/cli/sign/sign.go b/cmd/cosign/cli/sign/sign.go
@@ -32,6 +32,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/google/go-containerregistry/pkg/v1/types"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
@@ -51,6 +52,7 @@ import (
 	"github.com/sigstore/cosign/v2/pkg/oci"
 	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
 	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	"github.com/sigstore/cosign/v2/pkg/oci/walk"
 	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
@@ -233,7 +235,11 @@ func signDigest(ctx context.Context, digest name.Digest, payload []byte, ko opti
 	}
 
 	var s icos.Signer
-	s = ipayload.NewSigner(sv)
+	var staticOpts []static.StaticOption
+	if signOpts.PayloadPath != "" && signOpts.PayloadMediaType != "" {
+		staticOpts = append(staticOpts, static.WithLayerMediaType(types.MediaType(signOpts.PayloadMediaType)))
+	}
+	s = ipayload.NewSigner(sv, staticOpts)
 	if sv.Cert != nil {
 		s = ifulcio.NewSigner(s, sv.Cert, sv.Chain)
 	}
diff --git a/cmd/cosign/cli/verify/verify_blob.go b/cmd/cosign/cli/verify/verify_blob.go
@@ -113,7 +113,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 
 	// Keys are optional!
 	var cert *x509.Certificate
-	opts := make([]static.Option, 0)
+	staticOpts := make([]static.StaticOption, 0)
 	switch {
 	case c.KeyRef != "":
 		co.SigVerifier, err = sigs.PublicKeyFromKeyRef(ctx, c.KeyRef)
@@ -270,7 +270,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 			}
 			cert = bundleCert
 		}
-		opts = append(opts, static.WithBundle(b.Bundle))
+		staticOpts = append(staticOpts, static.WithBundle(b.Bundle))
 	}
 	if c.RFC3161TimestampPath != "" {
 		var rfc3161Timestamp bundle.RFC3161Timestamp
@@ -281,7 +281,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 		if err := json.Unmarshal(ts, &rfc3161Timestamp); err != nil {
 			return err
 		}
-		opts = append(opts, static.WithRFC3161Timestamp(&rfc3161Timestamp))
+		staticOpts = append(staticOpts, static.WithRFC3161Timestamp(&rfc3161Timestamp))
 	}
 	// Set an SCT if provided via the CLI.
 	if c.SCTRef != "" {
@@ -327,7 +327,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 		if err != nil {
 			return err
 		}
-		opts = append(opts, static.WithCertChain(certPEM, chainPEM))
+		staticOpts = append(staticOpts, static.WithCertChain(certPEM, chainPEM))
 	}
 
 	// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
@@ -342,7 +342,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 	if err != nil {
 		return err
 	}
-	signature, err := static.NewSignature(blobBytes, sig, opts...)
+	signature, err := static.NewSignature(blobBytes, sig, staticOpts...)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/cosign/cli/verify/verify_blob_attestation.go b/cmd/cosign/cli/verify/verify_blob_attestation.go
@@ -121,7 +121,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
 
 	// Keys are optional!
 	var cert *x509.Certificate
-	opts := make([]static.Option, 0)
+	staticOpts := make([]static.StaticOption, 0)
 	switch {
 	case c.KeyRef != "":
 		co.SigVerifier, err = sigs.PublicKeyFromKeyRef(ctx, c.KeyRef)
@@ -316,7 +316,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
 		if err != nil {
 			return fmt.Errorf("decoding signature: %w", err)
 		}
-		opts = append(opts, static.WithBundle(b.Bundle))
+		staticOpts = append(staticOpts, static.WithBundle(b.Bundle))
 	}
 	if c.RFC3161TimestampPath != "" {
 		var rfc3161Timestamp bundle.RFC3161Timestamp
@@ -327,7 +327,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
 		if err := json.Unmarshal(ts, &rfc3161Timestamp); err != nil {
 			return err
 		}
-		opts = append(opts, static.WithRFC3161Timestamp(&rfc3161Timestamp))
+		staticOpts = append(staticOpts, static.WithRFC3161Timestamp(&rfc3161Timestamp))
 	}
 	// Set an SCT if provided via the CLI.
 	if c.SCTRef != "" {
@@ -369,10 +369,10 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
 		if err != nil {
 			return err
 		}
-		opts = append(opts, static.WithCertChain(certPEM, chainPEM))
+		staticOpts = append(staticOpts, static.WithCertChain(certPEM, chainPEM))
 	}
 
-	signature, err := static.NewAttestation(encodedSig, opts...)
+	signature, err := static.NewAttestation(encodedSig, staticOpts...)
 	if err != nil {
 		return err
 	}
diff --git a/internal/pkg/cosign/payload/attestor.go b/internal/pkg/cosign/payload/attestor.go
@@ -67,9 +67,9 @@ func (pa *payloadAttestor) DSSEAttest(ctx context.Context, payload io.Reader) (o
 		return nil, nil, err
 	}
 
-	opts := []static.Option{static.WithLayerMediaType(types.DssePayloadType)}
+	staticOpts := []static.StaticOption{static.WithLayerMediaType(types.DssePayloadType)}
 
-	att, err := static.NewAttestation(envelopeJSON, opts...)
+	att, err := static.NewAttestation(envelopeJSON, staticOpts...)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -81,9 +81,9 @@ func (pa *payloadAttestor) DSSEAttest(ctx context.Context, payload io.Reader) (o
 // Option types other than `signature.SignOption` and `signature.PublicKeyOption` cause a runtime panic.
 func NewDSSEAttestor(payloadType string,
 	s signature.Signer,
-	signAndPublicKeyOptions ...interface{}) cosign.DSSEAttestor {
+	opts ...interface{}) cosign.DSSEAttestor {
 	return &payloadAttestor{
-		signer:      newSigner(s, signAndPublicKeyOptions...),
+		signer:      newSigner(s, opts...),
 		payloadType: payloadType,
 	}
 }
diff --git a/internal/pkg/cosign/payload/signer.go b/internal/pkg/cosign/payload/signer.go
@@ -33,6 +33,7 @@ type payloadSigner struct {
 	payloadSigner         signature.Signer
 	payloadSignerOpts     []signature.SignOption
 	publicKeyProviderOpts []signature.PublicKeyOption
+	staticOpts            []static.StaticOption
 }
 
 var _ cosign.Signer = (*payloadSigner)(nil)
@@ -53,7 +54,7 @@ func (ps *payloadSigner) Sign(ctx context.Context, payload io.Reader) (oci.Signa
 	}
 
 	b64sig := base64.StdEncoding.EncodeToString(sig)
-	ociSig, err := static.NewSignature(payloadBytes, b64sig)
+	ociSig, err := static.NewSignature(payloadBytes, b64sig, ps.staticOpts...)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -82,33 +83,35 @@ func (ps *payloadSigner) signPayload(ctx context.Context, payloadBytes []byte) (
 	return sig, nil
 }
 
-func newSigner(s signature.Signer,
-	signAndPublicKeyOptions ...interface{}) payloadSigner {
+func newSigner(s signature.Signer, opts ...interface{}) payloadSigner {
 	var sOpts []signature.SignOption
 	var pkOpts []signature.PublicKeyOption
+	var staticOpts []static.StaticOption
 
-	for _, opt := range signAndPublicKeyOptions {
+	for _, opt := range opts {
 		switch o := opt.(type) {
 		case signature.SignOption:
 			sOpts = append(sOpts, o)
 		case signature.PublicKeyOption:
 			pkOpts = append(pkOpts, o)
+		case static.StaticOption:
+			staticOpts = append(staticOpts, o)
 		default:
-			panic(fmt.Sprintf("options must be of type `signature.SignOption` or `signature.PublicKeyOption`. Got a %T: %v", o, o))
+			panic(fmt.Sprintf("options must be of type `signature.SignOption`, `signature.PublicKeyOption` or `static.Option`. Got a %T: %v", o, o))
 		}
 	}
 
 	return payloadSigner{
 		payloadSigner:         s,
+		staticOpts:            staticOpts,
 		payloadSignerOpts:     sOpts,
 		publicKeyProviderOpts: pkOpts,
 	}
 }
 
 // NewSigner returns a `cosign.Signer` which uses the given `signature.Signer` to sign requested payloads.
 // Option types other than `signature.SignOption` and `signature.PublicKeyOption` cause a runtime panic.
-func NewSigner(s signature.Signer,
-	signAndPublicKeyOptions ...interface{}) cosign.Signer {
-	signer := newSigner(s, signAndPublicKeyOptions...)
+func NewSigner(s signature.Signer, opts ...interface{}) cosign.Signer {
+	signer := newSigner(s, opts...)
 	return &signer
 }
diff --git a/pkg/cosign/verify_test.go b/pkg/cosign/verify_test.go
@@ -310,8 +310,8 @@ func TestVerifyImageSignatureWithNoChain(t *testing.T) {
 	rekorPubKeys := NewTrustedTransparencyLogPubKeys()
 	rekorPubKeys.AddTransparencyLogPubKey(pemBytes, tuf.Active)
 
-	opts := []static.Option{static.WithCertChain(pemLeaf, []byte{}), static.WithBundle(rekorBundle)}
-	ociSig, _ := static.NewSignature(payload, base64.StdEncoding.EncodeToString(signature), opts...)
+	staticOpts := []static.StaticOption{static.WithCertChain(pemLeaf, []byte{}), static.WithBundle(rekorBundle)}
+	ociSig, _ := static.NewSignature(payload, base64.StdEncoding.EncodeToString(signature), staticOpts...)
 
 	verified, err := VerifyImageSignature(context.TODO(), ociSig, v1.Hash{},
 		&CheckOpts{
@@ -354,8 +354,8 @@ func TestVerifyImageSignatureWithInvalidPublicKeyType(t *testing.T) {
 	// Add one valid key here.
 	rekorPubKeys.AddTransparencyLogPubKey(pemBytes, tuf.Active)
 
-	opts := []static.Option{static.WithCertChain(pemLeaf, []byte{}), static.WithBundle(rekorBundle)}
-	ociSig, _ := static.NewSignature(payload, base64.StdEncoding.EncodeToString(signature), opts...)
+	staticOpts := []static.StaticOption{static.WithCertChain(pemLeaf, []byte{}), static.WithBundle(rekorBundle)}
+	ociSig, _ := static.NewSignature(payload, base64.StdEncoding.EncodeToString(signature), staticOpts...)
 
 	// Then try to validate with keys that are not ecdsa.PublicKey and should
 	// fail.
diff --git a/pkg/oci/mutate/signature_test.go b/pkg/oci/mutate/signature_test.go
@@ -62,9 +62,9 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 `)
 )
 
-func mustCreateSignature(t *testing.T, payload []byte, b64sig string, opts ...static.Option) oci.Signature {
+func mustCreateSignature(t *testing.T, payload []byte, b64sig string, staticOpts ...static.StaticOption) oci.Signature {
 	t.Helper()
-	sig, err := static.NewSignature(payload, b64sig, opts...)
+	sig, err := static.NewSignature(payload, b64sig, staticOpts...)
 	if err != nil {
 		t.Fatalf("failed to create static signature: %v", err)
 	}
diff --git a/pkg/oci/static/file.go b/pkg/oci/static/file.go
@@ -29,8 +29,8 @@ import (
 )
 
 // NewFile constructs a new v1.Image with the provided payload.
-func NewFile(payload []byte, opts ...Option) (oci.File, error) {
-	o, err := makeOptions(opts...)
+func NewFile(payload []byte, staticOpts ...StaticOption) (oci.File, error) {
+	o, err := makeOptions(staticOpts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/oci/static/options.go b/pkg/oci/static/options.go
@@ -23,8 +23,8 @@ import (
 	ctypes "github.com/sigstore/cosign/v2/pkg/types"
 )
 
-// Option is a functional option for customizing static signatures.
-type Option func(*options)
+// StaticOption is a functional option for customizing static signatures.
+type StaticOption func(*options)
 
 type options struct {
 	LayerMediaType          types.MediaType
@@ -37,14 +37,14 @@ type options struct {
 	RecordCreationTimestamp bool
 }
 
-func makeOptions(opts ...Option) (*options, error) {
+func makeOptions(staticOpts ...StaticOption) (*options, error) {
 	o := &options{
 		LayerMediaType:  ctypes.SimpleSigningMediaType,
 		ConfigMediaType: types.OCIConfigJSON,
 		Annotations:     make(map[string]string),
 	}
 
-	for _, opt := range opts {
+	for _, opt := range staticOpts {
 		opt(o)
 	}
 
@@ -72,50 +72,50 @@ func makeOptions(opts ...Option) (*options, error) {
 }
 
 // WithLayerMediaType sets the media type of the signature.
-func WithLayerMediaType(mt types.MediaType) Option {
+func WithLayerMediaType(mt types.MediaType) StaticOption {
 	return func(o *options) {
 		o.LayerMediaType = mt
 	}
 }
 
 // WithConfigMediaType sets the media type of the signature.
-func WithConfigMediaType(mt types.MediaType) Option {
+func WithConfigMediaType(mt types.MediaType) StaticOption {
 	return func(o *options) {
 		o.ConfigMediaType = mt
 	}
 }
 
 // WithAnnotations sets the annotations that will be associated.
-func WithAnnotations(ann map[string]string) Option {
+func WithAnnotations(ann map[string]string) StaticOption {
 	return func(o *options) {
 		o.Annotations = ann
 	}
 }
 
 // WithBundle sets the bundle to attach to the signature
-func WithBundle(b *bundle.RekorBundle) Option {
+func WithBundle(b *bundle.RekorBundle) StaticOption {
 	return func(o *options) {
 		o.Bundle = b
 	}
 }
 
 // WithRFC3161Timestamp sets the time-stamping bundle to attach to the signature
-func WithRFC3161Timestamp(b *bundle.RFC3161Timestamp) Option {
+func WithRFC3161Timestamp(b *bundle.RFC3161Timestamp) StaticOption {
 	return func(o *options) {
 		o.RFC3161Timestamp = b
 	}
 }
 
 // WithCertChain sets the certificate chain for this signature.
-func WithCertChain(cert, chain []byte) Option {
+func WithCertChain(cert, chain []byte) StaticOption {
 	return func(o *options) {
 		o.Cert = cert
 		o.Chain = chain
 	}
 }
 
 // WithRecordCreationTimestamp sets the feature flag to honor the creation timestamp to time of running
-func WithRecordCreationTimestamp(rct bool) Option {
+func WithRecordCreationTimestamp(rct bool) StaticOption {
 	return func(o *options) {
 		o.RecordCreationTimestamp = rct
 	}
diff --git a/pkg/oci/static/options_test.go b/pkg/oci/static/options_test.go
diff --git a/pkg/oci/static/signature.go b/pkg/oci/static/signature.go

Original file line number	Diff line number	Diff line change
`@@ -170,9 +170,9 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {`
`170`	`170`	`return nil`
`171`	`171`	`}`
`172`	`172`
`173`		`- opts := []static.Option{static.WithLayerMediaType(types.DssePayloadType)}`
	`173`	`+ staticOpts := []static.StaticOption{static.WithLayerMediaType(types.DssePayloadType)}`
`174`	`174`	`if sv.Cert != nil {`
`175`		`- opts = append(opts, static.WithCertChain(sv.Cert, sv.Chain))`
	`175`	`+ staticOpts = append(staticOpts, static.WithCertChain(sv.Cert, sv.Chain))`
`176`	`176`	`}`
`177`	`177`	`var timestampBytes []byte`
`178`	`178`	`var tsaPayload []byte`
`@@ -206,7 +206,7 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {`
`206`	`206`	`}`
`207`	`207`	`bundle := cbundle.TimestampToRFC3161Timestamp(timestampBytes)`
`208`	`208`
`209`		`- opts = append(opts, static.WithRFC3161Timestamp(bundle))`
	`209`	`+ staticOpts = append(staticOpts, static.WithRFC3161Timestamp(bundle))`
`210`	`210`	`}`
`211`	`211`
`212`	`212`	`predicateType, err := options.ParsePredicateType(c.PredicateType)`
`@@ -218,7 +218,7 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {`
`218`	`218`	`"predicateType": predicateType,`
`219`	`219`	`}`
`220`	`220`	`// Add predicateType as manifest annotation`
`221`		`- opts = append(opts, static.WithAnnotations(predicateTypeAnnotation))`
	`221`	`+ staticOpts = append(staticOpts, static.WithAnnotations(predicateTypeAnnotation))`
`222`	`222`
`223`	`223`	`// Check whether we should be uploading to the transparency log`
`224`	`224`	`shouldUpload, err := sign.ShouldUploadToTlog(ctx, c.KeyOpts, digest, c.TlogUpload)`
`@@ -238,10 +238,10 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {`
`238`	`238`	`if err != nil {`
`239`	`239`	`return err`
`240`	`240`	`}`
`241`		`- opts = append(opts, static.WithBundle(cbundle.EntryToBundle(rekorEntry)))`
	`241`	`+ staticOpts = append(staticOpts, static.WithBundle(cbundle.EntryToBundle(rekorEntry)))`
`242`	`242`	`}`
`243`	`243`
`244`		`- sig, err := static.NewAttestation(signedPayload, opts...)`
	`244`	`+ sig, err := static.NewAttestation(signedPayload, staticOpts...)`
`245`	`245`	`if err != nil {`
`246`	`246`	`return err`
`247`	`247`	`}`
Original file line number	Diff line number	Diff line change
`@@ -113,7 +113,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {`
`113`	`113`
`114`	`114`	`// Keys are optional!`
`115`	`115`	`var cert *x509.Certificate`
`116`		`- opts := make([]static.Option, 0)`
	`116`	`+ staticOpts := make([]static.StaticOption, 0)`
`117`	`117`	`switch {`
`118`	`118`	`case c.KeyRef != "":`
`119`	`119`	`co.SigVerifier, err = sigs.PublicKeyFromKeyRef(ctx, c.KeyRef)`
`@@ -270,7 +270,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {`
`270`	`270`	`}`
`271`	`271`	`cert = bundleCert`
`272`	`272`	`}`
`273`		`- opts = append(opts, static.WithBundle(b.Bundle))`
	`273`	`+ staticOpts = append(staticOpts, static.WithBundle(b.Bundle))`
`274`	`274`	`}`
`275`	`275`	`if c.RFC3161TimestampPath != "" {`
`276`	`276`	`var rfc3161Timestamp bundle.RFC3161Timestamp`
`@@ -281,7 +281,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {`
`281`	`281`	`if err := json.Unmarshal(ts, &rfc3161Timestamp); err != nil {`
`282`	`282`	`return err`
`283`	`283`	`}`
`284`		`- opts = append(opts, static.WithRFC3161Timestamp(&rfc3161Timestamp))`
	`284`	`+ staticOpts = append(staticOpts, static.WithRFC3161Timestamp(&rfc3161Timestamp))`
`285`	`285`	`}`
`286`	`286`	`// Set an SCT if provided via the CLI.`
`287`	`287`	`if c.SCTRef != "" {`
`@@ -327,7 +327,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {`
`327`	`327`	`if err != nil {`
`328`	`328`	`return err`
`329`	`329`	`}`
`330`		`- opts = append(opts, static.WithCertChain(certPEM, chainPEM))`
	`330`	`+ staticOpts = append(staticOpts, static.WithCertChain(certPEM, chainPEM))`
`331`	`331`	`}`
`332`	`332`
`333`	`333`	`// Ignore Signed Certificate Timestamp if the flag is set or a key is provided`
`@@ -342,7 +342,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {`
`342`	`342`	`if err != nil {`
`343`	`343`	`return err`
`344`	`344`	`}`
`345`		`- signature, err := static.NewSignature(blobBytes, sig, opts...)`
	`345`	`+ signature, err := static.NewSignature(blobBytes, sig, staticOpts...)`
`346`	`346`	`if err != nil {`
`347`	`347`	`return err`
`348`	`348`	`}`
Original file line number	Diff line number	Diff line change
`@@ -121,7 +121,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st`
`121`	`121`
`122`	`122`	`// Keys are optional!`
`123`	`123`	`var cert *x509.Certificate`
`124`		`- opts := make([]static.Option, 0)`
	`124`	`+ staticOpts := make([]static.StaticOption, 0)`
`125`	`125`	`switch {`
`126`	`126`	`case c.KeyRef != "":`
`127`	`127`	`co.SigVerifier, err = sigs.PublicKeyFromKeyRef(ctx, c.KeyRef)`
`@@ -316,7 +316,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st`
`316`	`316`	`if err != nil {`
`317`	`317`	`return fmt.Errorf("decoding signature: %w", err)`
`318`	`318`	`}`
`319`		`- opts = append(opts, static.WithBundle(b.Bundle))`
	`319`	`+ staticOpts = append(staticOpts, static.WithBundle(b.Bundle))`
`320`	`320`	`}`
`321`	`321`	`if c.RFC3161TimestampPath != "" {`
`322`	`322`	`var rfc3161Timestamp bundle.RFC3161Timestamp`
`@@ -327,7 +327,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st`
`327`	`327`	`if err := json.Unmarshal(ts, &rfc3161Timestamp); err != nil {`
`328`	`328`	`return err`
`329`	`329`	`}`
`330`		`- opts = append(opts, static.WithRFC3161Timestamp(&rfc3161Timestamp))`
	`330`	`+ staticOpts = append(staticOpts, static.WithRFC3161Timestamp(&rfc3161Timestamp))`
`331`	`331`	`}`
`332`	`332`	`// Set an SCT if provided via the CLI.`
`333`	`333`	`if c.SCTRef != "" {`
`@@ -369,10 +369,10 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st`
`369`	`369`	`if err != nil {`
`370`	`370`	`return err`
`371`	`371`	`}`
`372`		`- opts = append(opts, static.WithCertChain(certPEM, chainPEM))`
	`372`	`+ staticOpts = append(staticOpts, static.WithCertChain(certPEM, chainPEM))`
`373`	`373`	`}`
`374`	`374`
`375`		`- signature, err := static.NewAttestation(encodedSig, opts...)`
	`375`	`+ signature, err := static.NewAttestation(encodedSig, staticOpts...)`
`376`	`376`	`if err != nil {`
`377`	`377`	`return err`
`378`	`378`	`}`
Original file line number	Diff line number	Diff line change
`@@ -67,9 +67,9 @@ func (pa *payloadAttestor) DSSEAttest(ctx context.Context, payload io.Reader) (o`
`67`	`67`	`return nil, nil, err`
`68`	`68`	`}`
`69`	`69`
`70`		`- opts := []static.Option{static.WithLayerMediaType(types.DssePayloadType)}`
	`70`	`+ staticOpts := []static.StaticOption{static.WithLayerMediaType(types.DssePayloadType)}`
`71`	`71`
`72`		`- att, err := static.NewAttestation(envelopeJSON, opts...)`
	`72`	`+ att, err := static.NewAttestation(envelopeJSON, staticOpts...)`
`73`	`73`	`if err != nil {`
`74`	`74`	`return nil, nil, err`
`75`	`75`	`}`
`@@ -81,9 +81,9 @@ func (pa *payloadAttestor) DSSEAttest(ctx context.Context, payload io.Reader) (o`
`81`	`81`	// Option types other than `signature.SignOption` and `signature.PublicKeyOption` cause a runtime panic.
`82`	`82`	`func NewDSSEAttestor(payloadType string,`
`83`	`83`	`s signature.Signer,`
`84`		`- signAndPublicKeyOptions ...interface{}) cosign.DSSEAttestor {`
	`84`	`+ opts ...interface{}) cosign.DSSEAttestor {`
`85`	`85`	`return &payloadAttestor{`
`86`		`- signer: newSigner(s, signAndPublicKeyOptions...),`
	`86`	`+ signer: newSigner(s, opts...),`
`87`	`87`	`payloadType: payloadType,`
`88`	`88`	`}`
`89`	`89`	`}`
Original file line number	Diff line number	Diff line change
`@@ -62,9 +62,9 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==`
`62`	`62`	`)
`63`	`63`	`)`
`64`	`64`
`65`		`-func mustCreateSignature(t *testing.T, payload []byte, b64sig string, opts ...static.Option) oci.Signature {`
	`65`	`+func mustCreateSignature(t *testing.T, payload []byte, b64sig string, staticOpts ...static.StaticOption) oci.Signature {`
`66`	`66`	`t.Helper()`
`67`		`- sig, err := static.NewSignature(payload, b64sig, opts...)`
	`67`	`+ sig, err := static.NewSignature(payload, b64sig, staticOpts...)`
`68`	`68`	`if err != nil {`
`69`	`69`	`t.Fatalf("failed to create static signature: %v", err)`
`70`	`70`	`}`