Signing with tlog upload is not idempotent

[reedloden]

Description

We sign our images during the final stage of our release. However, because of the sheer amount of things that happen in that "promotion" stage, it is sometimes necessary to re-run it. cosign 1.x didn't have an issue with this, as signatures were not uploaded automatically to the transparency log. However, with cosign 2.x, we're running into an issue due to a signature already existing:

$ cosign sign --yes --key awskms:///... --recursive public.ecr.aws/foo/bar@sha256:abcdef...

...

Signature already exists. Displaying proof
Error: signing [public.ecr.aws/foo/bar@sha256:abcdef...]: recursively signing: signing digest: unexpected entry returned from rekor server: expected EntryUUID 24296fb24b8ad77aa8f736fc36ff0184b30419c0347d81b22f5d3328592015e2369a8f71bc741bac got UUID 24296fb24b8ad77aa8f736fc36ff0184b30419c0347d81b22f5d3328592015e2369a8f71bc741bac from Tree c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d
main.go:74: error during command execution: signing [public.ecr.aws/foo/bar@sha256:abcdef...]: recursively signing: signing digest: unexpected entry returned from rekor server: expected EntryUUID 24296fb24b8ad77aa8f736fc36ff0184b30419c0347d81b22f5d3328592015e2369a8f71bc741bac got UUID 24296fb24b8ad77aa8f736fc36ff0184b30419c0347d81b22f5d3328592015e2369a8f71bc741bac from Tree c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d

cosign/pkg/cosign/tlog.go

Lines 207 to 224 in aaa354d

	// If the entry already exists, we get a specific error.
	// Here, we display the proof and succeed.
	var existsErr *entries.CreateLogEntryConflict
	if errors.As(err, &existsErr) {
	ui.Infof(ctx, "Signature already exists. Displaying proof")
	uriSplit := strings.Split(existsErr.Location.String(), "/")
	uuid := uriSplit[len(uriSplit)-1]
	e, err := GetTlogEntry(ctx, rekorClient, uuid)
	if err != nil {
	return nil, err
	}
	rekorPubsFromAPI, err := rekorPubsFromClient(rekorClient)
	if err != nil {
	return nil, err
	}
	return e, VerifyTLogEntryOffline(ctx, e, rekorPubsFromAPI)
	}
	return nil, err

makes it seem like signing an image multiple times is fine (and it's what I would expect).

Version

cosign 2.2.1

[haydentherapper]

Lemme dig in, this is definitely a bug.

[haydentherapper]

@reedloden Fixed in #3371