Description
In release v3.0.2, the -a, --annotations option is no longer shown in the optional field of the hash during verification. This behavior was present in v2.6.1.
Command used to sign:
cosign sign --tlog-upload --use-signing-config=false --key "$KEY_FILE_PATH" -a metadata_hash="$METADATA_HASH" "$IMAGE_WITH_DIGEST"
Commmand used for verification:
./cosign-darwin-arm64 verify --insecure-ignore-tlog --key cosign.pub <registry>/<image>:<tag>
Output: