Repository navigation
cosign bundle create should support images #5138
Description
Activity
I started thinking about this today, but there's at least one rather large problem.
Today, cosign subcommands are either oriented towards OCI registries (
sign,attest,download) or files on disk (sign-blob,verify-blob, ...)bundle createtoday is oriented towards files on disk, and there would not be a lot of overlap between the existing flags and the flags needed for the OCI case (--registry-*,--allow-http-registry,--allow-insecure-registry, etc).Should we try to have one subcommand
bundle createto handle both files on disk and OCI registries? Or should we have an OCI version ofbundle create(and if so what should we call it)?
Description
Currently,
cosign bundle createonly supports converting bundles on disk. We should make sure that we have a good migration story for images as well.