added ability to get image digest back via triangulate

cmd/cosign/cli/options/triangulate.go

@@ -32,5 +32,5 @@ func (o *TriangulateOptions) AddFlags(cmd *cobra.Command) {
 	o.Registry.AddFlags(cmd)
 
 	cmd.Flags().StringVar(&o.Type, "type", "signature",
-		"related attachment to triangulate (attestation|sbom|signature), default signature (sbom is deprecated)")
+		"related attachment to triangulate (attestation|sbom|signature|digest), default signature (sbom is deprecated)")
 }

cmd/cosign/cli/triangulate/triangulate.go

@@ -38,21 +38,29 @@ func MungeCmd(ctx context.Context, regOpts options.RegistryOptions, imageRef str
 	}
 
 	var dstRef name.Tag
+	var dstRefName string
+
 	switch attachmentType {
 	case cosign.Signature:
 		dstRef, err = ociremote.SignatureTag(ref, ociremoteOpts...)
+		dstRefName = dstRef.Name()
 	case cosign.SBOM:
 		fmt.Fprintln(os.Stderr, options.SBOMAttachmentDeprecation)
 		dstRef, err = ociremote.SBOMTag(ref, ociremoteOpts...)
+		dstRefName = dstRef.Name()
 	case cosign.Attestation:
 		dstRef, err = ociremote.AttestationTag(ref, ociremoteOpts...)
+		dstRefName = dstRef.Name()
+	case cosign.Digest:
+		dstRef, err = ociremote.DigestTag(ref, ociremoteOpts...)
+		dstRefName = fmt.Sprint(dstRef.Repository.Name(), "@", dstRef.TagStr())
 	default:
 		err = fmt.Errorf("unknown attachment type %s", attachmentType)
 	}
 	if err != nil {
 		return err
 	}
 
-	fmt.Println(dstRef.Name())
+	fmt.Println(dstRefName)
 	return nil
 }

pkg/cosign/fetch.go

@@ -64,6 +64,7 @@ const (
 	Signature   = "signature"
 	SBOM        = "sbom"
 	Attestation = "attestation"
+	Digest      = "digest"
 )
 
 func FetchSignaturesForReference(_ context.Context, ref name.Reference, opts ...ociremote.Option) ([]SignedPayload, error) {

pkg/oci/remote/remote.go

@@ -97,31 +97,43 @@ func SignedEntity(ref name.Reference, options ...Option) (oci.SignedEntity, erro
 // normalize turns image digests into tags with optional prefix & suffix:
 // sha256:d34db33f -> [prefix]sha256-d34db33f[.suffix]
 func normalize(h v1.Hash, prefix string, suffix string) string {
+	return normalizeWithSeparator(h, prefix, suffix, "-")
+}
+
+// normalizeWithSeparator turns image digests into tags with optional prefix & suffix:
+// sha256:d34db33f -> [prefix]sha256[algorithmSeparator]d34db33f[.suffix]
+func normalizeWithSeparator(h v1.Hash, prefix string, suffix string, algorithmSeparator string) string {
 	if suffix == "" {
-		return fmt.Sprint(prefix, h.Algorithm, "-", h.Hex)
+		return fmt.Sprint(prefix, h.Algorithm, algorithmSeparator, h.Hex)
 	}
-	return fmt.Sprint(prefix, h.Algorithm, "-", h.Hex, ".", suffix)
+	return fmt.Sprint(prefix, h.Algorithm, algorithmSeparator, h.Hex, ".", suffix)
 }
 
 // SignatureTag returns the name.Tag that associated signatures with a particular digest.
 func SignatureTag(ref name.Reference, opts ...Option) (name.Tag, error) {
 	o := makeOptions(ref.Context(), opts...)
-	return suffixTag(ref, o.SignatureSuffix, o)
+	return suffixTag(ref, o.SignatureSuffix, "-", o)
 }
 
 // AttestationTag returns the name.Tag that associated attestations with a particular digest.
 func AttestationTag(ref name.Reference, opts ...Option) (name.Tag, error) {
 	o := makeOptions(ref.Context(), opts...)
-	return suffixTag(ref, o.AttestationSuffix, o)
+	return suffixTag(ref, o.AttestationSuffix, "-", o)
 }
 
 // SBOMTag returns the name.Tag that associated SBOMs with a particular digest.
 func SBOMTag(ref name.Reference, opts ...Option) (name.Tag, error) {
 	o := makeOptions(ref.Context(), opts...)
-	return suffixTag(ref, o.SBOMSuffix, o)
+	return suffixTag(ref, o.SBOMSuffix, "-", o)
+}
+
+// DigestTag returns the name.Tag that associated SBOMs with a particular digest.
+func DigestTag(ref name.Reference, opts ...Option) (name.Tag, error) {
+	o := makeOptions(ref.Context(), opts...)
+	return suffixTag(ref, "", ":", o)
 }
 
-func suffixTag(ref name.Reference, suffix string, o *options) (name.Tag, error) {
+func suffixTag(ref name.Reference, suffix string, algorithmSeparator string, o *options) (name.Tag, error) {
 	var h v1.Hash
 	if digest, ok := ref.(name.Digest); ok {
 		var err error
@@ -136,7 +148,7 @@ func suffixTag(ref name.Reference, suffix string, o *options) (name.Tag, error)
 		}
 		h = desc.Digest
 	}
-	return o.TargetRepository.Tag(normalize(h, o.TagPrefix, suffix)), nil
+	return o.TargetRepository.Tag(normalizeWithSeparator(h, o.TagPrefix, suffix, algorithmSeparator)), nil
 }
 
 // signatures is a shared implementation of the oci.Signed* Signatures method.