cosign sign record-creation-timestamp=true not taken into account for new bundle format

[baal-lgln]

Description

Since v3 the record-creation-timestamp=true parameter for the cosign sign command is no longer taken into account in our IBM Container registry for the new bundle format and no date is added to the OCI manifest in our registry.

The problem is that we have rules inside this registry to delete "old" manifests and manifests without dates are recognized as old manifests.
The same problem is described in detail here:

• OCI manifest created timestamp wrong with v2.2.0 #3298
• Add support for recording creation timestamp for cosign attest #3797

These screenshots show how the old format is correctly shown with da date (created with the workaround --new-bundle-format=false --use-signing-config=false) and the new bundle format is without a date:

Is there any way to add a date without using the workaround --new-bundle-format=false --use-signing-config=false?

Version
cosign v3.0.2

[cmurphy]

The creation time is now recorded on an annotation on the manifest regardless of whether the flag was set. Will that suffice?

Example:

$ go run cmd/cosign/main.go sign -y  --key=cosign.key  localhost:5000/wolfi-base:latestWARNING: Image reference localhost:5000/wolfi-base:latest uses a tag, not a digest, to identify the image to sign.
    This can lead you to sign a different image than the intended one. Please use a
    digest (example.com/ubuntu@sha256:abc123...) rather than tag
    (example.com/ubuntu:latest) for the input to cosign. The ability to refer to
    images by tag will be removed in a future release.

Enter password for private key:
$ crane ls localhost:5000/wolfi-base
sha256-0d1673dd55e8b7535fea5191c8337f0c18f46d55ed9020b9dcc1a2e17c550680.sig
latest
sha256-0d1673dd55e8b7535fea5191c8337f0c18f46d55ed9020b9dcc1a2e17c550680
$ crane manifest localhost:5000/wolfi-base@$(crane manifest localhost:5000/wolfi-base:sha256-0d1673dd55e8b7535fea5191c8337f0c18f46d55ed9020b9dcc1a2e17c550680 | jq -r .manifests[0].digest) | jq '.annotations."org.opencontainers.image.created"'
"2025-10-27T21:53:49Z"

[baal-lgln]

I tested cosign sign --yes --key with the latest version but no annotation with the creation date is added to the manifest for us:

{
  "manifest": {
    "schemaVersion": 2,
    "mediaType": "application/vnd.oci.image.index.v1+json",
    "manifests": [
      {
        "mediaType": "application/vnd.oci.image.manifest.v1+json",
        "size": 889,
        "digest": "sha256:XXX",
        "artifactType": "application/vnd.oci.empty.v1+json"
      }
    ],
    "manifestType": "OCI Image Index v1",
    "manifestShortName": "OCI Index"
  },
  "constituents": [
    {
      "digest": "XXX",
      "repo": "de.icr.io/XXX,
      "id": "eyXXX=",
      "longDigest": "sha256:XXX",
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "size": 889,
      "manifestType": "OCI Image Manifest v1",
      "manifestShortName": "OCI"
    }
  ]
}

So every OCI Index does not show any date in our registry:

[cmurphy]

Does IBM Container Registry need the annotation to appear on the vnd.oci.image.index.v1+json index itself, or will it read it if the annotation appears listed under manifests within the index?

If the latter would work, there is an open PR in go-containerregistry to populate the annotation on the manifest descriptor in the index: google/go-containerregistry#1998

[baal-lgln]

Thank you for investigating this. As we are not able to answer those questions we opened a support ticket and asked the IBM Container Registry Support.