Can't pull and discover the signature pushed by notation sign

[FeynmanZhou]

Hi there,

I use notation sign to sign a container image in ACR, then I can find the signature pushed by notation from the ACR portal. However, I can't pull and discover the signature using oras pull and oras discover.

$ notation sign feynmanacr.azurecr.io/sample/hello-world:latest
sha256:123456

$ oras pull feynmanacr.azurecr.io/sample/hello-world:latest
Downloaded empty artifact
Pulled feynmanacr.azurecr.io/sample/hello-world:latest
Digest: sha256:123456

$ oras discover feynmanacr.azurecr.io/sample/hello-world:latest
Discovered 0 artifact referencing feynmanacr.azurecr.io/sample/hello-world:latest

From my understanding, the signature pushed by notation sign is supposed to be referencing the signed container image. Thus users can pull the signature using oras pull. Is anything I missed here?

Version

• Notation v0.11.0-alpha.4
• ORAS 0.16-alpha

[sajayantony]

ORAS 0.16 works with ACR? Wasn’t that supposed to use OCI artifacts?

[FeynmanZhou]

@sajayantony I am just aware of it. Now it works to discover the pushed signature using oras discover when I change to ORAS 0.15.1. But I can't pull the signature due to it returning empty. The reason is that the pushed signature doesn't have a file name. oras pull only supports pull artifacts that have a file name.

$ oras discover feynmanacr.azurecr.io/sample/hello-world:latest -o tree
feynmanacr.azurecr.io/sample/hello-world:latest
└── application/vnd.cncf.notary.v2.signature
    └── sha256: abc123