Ali Asghar 43d83e8490 fix(layout): preserve manifest artifactType in index.json when saving (#4821) ...

When cosign save writes an OCI artifact to disk, partial.Descriptor falls
back to config.mediaType as the artifactType in the index.json descriptor
because go-containerregistry's v1.Manifest struct does not expose the
manifest-level artifactType field. The result is that config.mediaType
appears as the artifactType entry in index.json instead of the correct
manifest artifactType, violating the OCI Image Layout spec.

Fix appendImage to parse the raw manifest JSON and override the descriptor's
ArtifactType field when a top-level artifactType is present. The existing
config.mediaType fallback still applies when artifactType is absent.

Fixes #4694

Signed-off-by: Ali <alliasgher123@gmail.com>

2026-09-14 16:24:02 -07:00

..

index.go

Bump module version to v3 for Cosign v3.0 (#4427)

2025-09-26 13:31:26 -07:00

signatures_test.go

Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)

2024-04-10 14:57:21 -07:00

signatures.go

Bump module version to v3 for Cosign v3.0 (#4427)

2025-09-26 13:31:26 -07:00

write_test.go

fix(layout): preserve manifest artifactType in index.json when saving (#4821)

2026-09-14 16:24:02 -07:00

write.go

fix(layout): preserve manifest artifactType in index.json when saving (#4821)

2026-09-14 16:24:02 -07:00