Issue with --output-certificate in cosign sign-blob

[nicxso]

Both cosign sign and cosign sign-blob commands support the --output-certificate parameter, but they behave differently when signing with a private key.

Example with cosign sign (image signing):

cosign sign --key cosign.key --output-certificate certificate.crt --output-signature signature.sig --record-creation-timestamp --tlog-upload=false --upload=false hello-world:latest

In this example, when signing an image using cosign sign, the --output-certificate flag generates a certificate containing the public key.

Example with cosign sign-blob (blob signing):

cosign sign-blob --key cosign.key --output-certificate certificate.crt --output-signature signature.sig --tlog-upload=false test-zip-file.zip

However, when signing a blob using cosign sign-blob, despite the presence of the --output-certificate flag, no certificate is generated.

My question is:

Why does signing an image generate a certificate with the public key, but signing a blob does not? How does the --output-certificate flag work in this context for blobs or in general?

I understand that when a blob is signed using the keyless method, a certificate is generated, but this behavior seems different when using the private key for signing.

[haydentherapper]

Good find! It looks like for sign-blob, a certificate is output only if there's actually a certificate. For sign, we encode the public key here if there is no certificate.

Can you confirm that the output certificate is actually a base64 encoded key?

[nicxso]

Yes, the output certificate is a base64 encoded key. Example command:

cosign sign --key cosign.key --output-certificate certificate.crt --output-signature signature.sig --record-creation-timestamp --tlog-upload=false --upload=false hello-world:latest

The generated certificate (certificate.crt) contains the encoded public key:

-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmKoBl7G7kgeCTSiCYQtFOXNOHhzg DE5x13H/NvWp/w+vT7gt3kQa2gy9uUqwtACTIPTemBafos8ibpotAbGvCQ== -----END PUBLIC KEY-----

[tommyd450]

Hey so I have been actually trying to look into this but im Still fairly new to this and how it all works, when passing in a key imported by cosign for use /x/crypto/x509 reports out x509: malformed serial number. If it is any assistance?

[haydentherapper]

Keys shouldn't get parsed by crypto/x509 since that library is for certificates. With the links above, we just need to add a check that the output is actually a certificate.