Cannot verify keyless signatures created with cosign v3.0.2 and policy-controller 0.13.1

[mganter]

Description

When i try to deploy a image signed with cosign v3.0.2, policy-controller cannot find the signature

Error from server (BadRequest): error when creating "deployment.yaml": admission webhook "policy.sigstore.dev" denied the request: validation failed: failed policy: cip-key-secret: spec.template.spec.containers[0].image
ghcr.io/mganter/cosign-policy-controller-test@sha256:c96ad034a6568eec4e8c77f92c90b88d8d69f7bd31e60a9fc4d93800aec75fc9 signature keyless validation failed for authority authority-0 for ghcr.io/mganter/cosign-policy-controller-test@sha256:c96ad034a6568eec4e8c77f92c90b88d8d69f7bd31e60a9fc4d93800aec75fc9: no signatures found

while cosign v3.0.2 can find the signature

> cosign verify --certificate-identity-regexp="^https://github.com/mganter/cosign-policy-controller-test" --certificate-oidc-issuer="https://token.actions.githubusercontent.com" ghcr.io/mganter/cosign-policy-controller-test@sha256:c96ad034a6568eec4e8c77f92c90b88d8d69f7bd31e60a9fc4d93800aec75fc9 -o text

Verification for ghcr.io/mganter/cosign-policy-controller-test@sha256:c96ad034a6568eec4e8c77f92c90b88d8d69f7bd31e60a9fc4d93800aec75fc9 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates
{"critical":{"identity":{"docker-reference":"ghcr.io/mganter/cosign-policy-controller-test@sha256:c96ad034a6568eec4e8c77f92c90b88d8d69f7bd31e60a9fc4d93800aec75fc9"},"image":{"docker-manifest-digest":"sha256:c96ad034a6568eec4e8c77f92c90b88d8d69f7bd31e60a9fc4d93800aec75fc9"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":null}

apiVersion: policy.sigstore.dev/v1alpha1
kind: ClusterImagePolicy
metadata:
  name: cip-key-secret
spec:
  images:
    - glob: "ghcr.io/mganter/**"
  authorities:
    - keyless:
        url: https://fulcio.sigstore.dev
        identities:
          - issuer: "https//token.actions.githubusercontent.com"
            subjectRegExp: "^https://github.com/mganter/cosign-policy-controller-test"
  mode: enforce

See Github Example Project

Version

> cosign version
  ______   ______        _______. __    _______ .__   __.
 /      | /  __  \      /       ||  |  /  _____||  \ |  |
|  ,----'|  |  |  |    |   (----`|  | |  |  __  |   \|  |
|  |     |  |  |  |     \   \    |  | |  | |_ | |  . `  |
|  `----.|  `--'  | .----)   |   |  | |  |__| | |  |\   |
 \______| \______/  |_______/    |__|  \______| |__| \__|
cosign: A tool for Container Signing, Verification and Storage in an OCI registry.

GitVersion:    v3.0.2
GitCommit:     84449696f0658a5ef5f2abba87fdd3f8b17ca1be
GitTreeState:  "clean"
BuildDate:     2025-10-10T18:17:56Z
GoVersion:     go1.25.2
Compiler:      gc
Platform:      darwin/arm64

Version in github action:

      - name: Install Cosign
        uses: sigstore/cosign-installer@v4.0.0
        with:
          cosign-release: "v3.0.2"

Policy controller: ghcr.io/sigstore/policy-controller/policy-controller@sha256:0bcd60beb93f4427c29cf3a669743caf58490e98ded4380c33c09f092734a6ab

[hectorj2f]

@mganter Thanks for opening this issue. I'll try to fix it as soon as I get a little bit of time 😓 .