Tosone 46c0f402e8 fix(build): sign images with a cosign v3 signing config ...

The builder image ships cosign v3, which uses a signing config by default and
rejects the deprecated --tlog-upload flag, so every build failed at the signing
step with "--tlog-upload=false is not supported with --signing-config or
--use-signing-config".

Pass a signing config without transparency log services instead. Sigma keeps
the generated signatures as OCI artifacts in its own registry, so nothing
should be uploaded to a public log. The key and the signing config are written
to temporary files that are removed afterwards; the key file is closed now as
well.

Verification:
- go build ./pkg/distribution/signing/...
- golangci-lint run ./pkg/distribution/signing/...
- Ran the resulting cosign v3.1.4 command (signing config, http registry,
  registry token, referrers mode) from the builder image: no flag or
  transparency log error, only the expected connection error to a dead
  registry.

2026-10-28 16:15:37 +08:00

..

clients

refactor(clients): propagate request context through registry clients

2026-10-03 16:20:36 +08:00

reference

docs: complete placeholder doc comments across the codebase

2026-09-14 14:58:06 +08:00

signing

fix(build): sign images with a cosign v3 signing config

2026-10-28 16:15:37 +08:00