Switch from cosign copy to oras copy (sigstore#4819)

cosign copy does not copy referring artifacts, so we'll use oras instead
as part of the build step.

Fixes sigstore#4818

Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

Author: Hayden-IO

release/cloudbuild.yaml

@@ -73,6 +73,7 @@ steps:
     env:
       - "GOPATH=/workspace/go"
       - "GOBIN=/workspace/bin"
+      - "DOCKER_CONFIG=/workspace/.docker"
       - PROJECT_ID=${PROJECT_ID}
       - KEY_LOCATION=${_KEY_LOCATION}
       - KEY_RING=${_KEY_RING}
@@ -90,7 +91,44 @@ steps:
       - '-c'
       - |
         echo $$GITHUB_TOKEN | docker login ghcr.io -u $$GITHUB_USER --password-stdin \
-        && make sign-release-images && make copy-signed-release-to-ghcr || true
+        && make sign-release-images || true
+
+  - name: 'ghcr.io/oras-project/oras:v1.3.1@sha256:96ef3b6ddc71d8a6b7bcdae517f6b696bcb4f8abac4ea62beec1ee482f433a83'
+    env:
+      - 'DOCKER_CONFIG=/workspace/.docker'
+    args:
+      - 'copy'
+      - '-r'
+      - 'gcr.io/${PROJECT_ID}/cosign:${_GIT_TAG}'
+      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}'
+
+  - name: 'ghcr.io/oras-project/oras:v1.3.1@sha256:96ef3b6ddc71d8a6b7bcdae517f6b696bcb4f8abac4ea62beec1ee482f433a83'
+    env:
+      - 'DOCKER_CONFIG=/workspace/.docker'
+    args:
+      - 'copy'
+      - '-r'
+      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}'
+      - '${_GHCR_PREFIX}/cosign:latest'
+
+  - name: 'ghcr.io/oras-project/oras:v1.3.1@sha256:96ef3b6ddc71d8a6b7bcdae517f6b696bcb4f8abac4ea62beec1ee482f433a83'
+    env:
+      - 'DOCKER_CONFIG=/workspace/.docker'
+    args:
+      - 'copy'
+      - '-r'
+      - 'gcr.io/${PROJECT_ID}/cosign:${_GIT_TAG}-dev'
+      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}-dev'
+
+  - name: 'ghcr.io/oras-project/oras:v1.3.1@sha256:96ef3b6ddc71d8a6b7bcdae517f6b696bcb4f8abac4ea62beec1ee482f433a83'
+    env:
+      - 'DOCKER_CONFIG=/workspace/.docker'
+    args:
+      - 'copy'
+      - '-r'
+      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}-dev'
+      - '${_GHCR_PREFIX}/cosign:latest-dev'
+
 
 availableSecrets:
   secretManager:
@@ -123,3 +161,5 @@ substitutions:
   _KEY_VERSION: '1'
   _KEY_LOCATION: 'global'
   _GITHUB_USER: 'placeholder'
+  _GHCR_PREFIX: 'ghcr.io/sigstore/cosign'
+

release/release.mk

@@ -19,14 +19,3 @@ sign-release-images: ko
 .PHONY: snapshot
 snapshot:
 	LDFLAGS="$(LDFLAGS)" goreleaser release --skip=sign,publish --snapshot --clean --timeout 120m --parallelism 1
-
-####################
-# copy image to GHCR
-####################
-
-.PHONY: copy-signed-release-to-ghcr
-copy-signed-release-to-ghcr:
-	cosign copy $(KO_PREFIX)/cosign:$(GIT_VERSION) $(GHCR_PREFIX)/cosign:$(GIT_VERSION)
-	cosign copy --force=true $(GHCR_PREFIX)/cosign:$(GIT_VERSION) $(GHCR_PREFIX)/cosign:latest
-	cosign copy $(KO_PREFIX)/cosign:$(GIT_VERSION)-dev $(GHCR_PREFIX)/cosign:$(GIT_VERSION)-dev
-	cosign copy --force=true $(GHCR_PREFIX)/cosign:$(GIT_VERSION)-dev $(GHCR_PREFIX)/cosign:latest-dev