adding warning to pin to digest (#2311)

Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: chaosinthecrd <[email protected]>
sigstore · Oct 5, 2022 · 91b03f2 · 91b03f2
1 parent 4f82d96
commit 91b03f2
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/cmd/cosign/cli/sign/sign.go b/cmd/cosign/cli/sign/sign.go
@@ -151,6 +151,10 @@ func SignCmd(ro *options.RootOptions, ko options.KeyOpts, regOpts options.Regist
 			return fmt.Errorf("unable to resolve attachment %s for image %s", attachment, inputImg)
 		}
 
+                if _, ok := ref.(name.Tag); ok {
+                   fmt.Println("Warning: Tag used in reference to identify the image. Consider supplying the digest for immutability.")
+                }
+
 		if digest, ok := ref.(name.Digest); ok && !recursive {
 			se, err := ociremote.SignedEntity(ref, opts...)
 			if err != nil {