Which Tool Mirrors a Cosign-Signed Image into a Private Registry?

aleks — Mon, 06 Jul 2026 00:00:00 +0000

regctl</code> is the most complete option — it exposes the legacy tag-based signature scheme and the modern OCI 1.1 referrers API as two separate, explicit flags. oras cp -r</code> is the second choice, and the tool cosign’s own project points to now that cosign copy</code> is deprecated. oc-mirror v2</code> looks like it should be on this list but actually solves a different, unrelated signature problem.</p>

The problem

🔗</a></h2>
Verifying a signature only works if the signature actually travels with the image. Anyone mirroring
a Cosign-signed image into a private or air-gapped registry needs the copy step itself to carry the
signature along, not just the layers — and that is not automatic. Some tools drop it silently, some
need a config flag turned on first, and one widely-used tool solves a related but entirely different
problem. k8s-scale-app-rs</a> is the worked example
throughout this post — its own container images are signed keylessly with cosign, carry an SBOM and
SLSA build provenance, and its “Verifying a published image”</a>
section shows what verification actually checks. This post is about what happens before</em>
verification: getting the signature into the registry the verifier will actually query.</p>
A short, sourced comparison, checked directly against each project’s docs/source (as of July 2026):</p>
A naming trap worth knowing first🔗</a></h2>
Red Hat’s oc-mirror v2</code> — the tool for mirroring into disconnected OpenShift installs — has its
own --secure-policy</code>/--remove-signatures</code>/--registries.d</code> flags, but they implement Red Hat’s
older “simple signing” scheme: a policy.json</code> plus GPG keys plus an external sigstore:</code> URL (e.g.
mirror.openshift.com/pub/openshift-v4/signatures</code> for OpenShift release images). That predates,
and has nothing to do with, the CNCF Sigstore project this post’s cosign workflow uses — same word,
unrelated mechanism. oc-mirror v2</code> went GA in OpenShift 4.18 (release
notes</a>),
but its ImageSetConfiguration</code> API is still v2alpha1</code>, and none of Red Hat’s own walkthroughs for
it touch Cosign-style signatures at all.</p>
Tool comparison🔗</a></h2>
Tool</th> Legacy tag-based signature (sha256-<digest>.sig</code>)</th> OCI 1.1 referrers (modern Cosign/SBOM/attestations)</th> Note</th></tr></thead>

regctl image copy</code></a></td> --digest-tags</code></td> --referrers</code></td> only tool here with separate, explicit flags for both schemes</td></tr>
oras cp -r</code></a></td> via -r</code></td> -r</code> (marked “Preview”)</td> --from/to-distribution-spec</code> handles referrers-tag vs. referrers-API mismatches between registries</td></tr>
skopeo copy</code></td> opt-in</td> not supported</td> needs use-sigstore-attachments: true</code> under the default-docker</code> key in registries.d</code>, on both source and destination</td></tr>
Zot registry sync</code></td> syncLegacyCosignTags</code> (default true</code>)</td> only with preserveDigest: true</code></td> without preserveDigest</code>, Zot re-encodes Docker-format images to OCI on sync, which changes the digest and detaches the signature</td></tr>
cosign copy</code></td> yes</td> no</td> deprecated</strong> as of sigstore/cosign#4681</a> (merged 2026-02-04) — the tool itself now points to oras copy -r</code> instead</td></tr>
crane copy</code></td> only incidentally, via --all-tags</code></td> no</td> plain manifest/layer copier, no signature awareness at all</td></tr>
Harbor replication</td> per Harbor’s own docs, yes</td> open gap (goharbor/harbor#23210</a>)</td> works for the legacy scheme; OCI 1.1 referrers replication is not yet reliable</td></tr>
</tbody></table>
regctl</code> is the only tool in this comparison that exposes both signature schemes as distinct,
intentional flags rather than as a side effect of copying “everything.” For a registry pair that
already speaks the OCI 1.1 referrers API end to end, oras cp -r</code> is the other option worth
checking — it’s what the cosign project’s own deprecation notice for cosign copy</code> points to.</p>
Example: mirroring with regctl🔗</a></h2>
Here is an example command to mirror k8s-scale-app-rs</code> itself, signature included, using regctl</code>:</p>
regctl</span> image</span> copy</span> \</span></span>
  -</span>-digest-tags</span> -</span>-referrers</span> \</span></span>
  ghcr.io/git001/k8s-scale-app-rs:v1.0.0</span> \</span></span>
  my-private-registry.example.com/k8s-scale-app-rs:v1.0.0</span></span></code></pre>Sources🔗</a></h2>

sigstore/cosign PR #4681 — “Deprecate cosign copy”</a></li>
sigstore/cosign#4335 — Complete OCI 1.1 Referrers API Support Across All Cosign Commands</a></li>
sigstore/cosign#4564 — cosign verify fails after cosign copy (JFrog Artifactory)</a></li>
podman-container-tools/skopeo#2061 — sigstore signature copying and use-sigstore-attachments</code></a></li>
regctl image copy</code> reference</a></li>
oras cp</code> command reference</a></li>
goharbor/harbor#23210 — OCI 1.1 referrers not replicated</a></li>
Zot registry: mirroring/sync documentation</a></li>
OpenShift Container Platform 4.18 release notes</a></li>
openshift/oc-mirror — signature-verification.md</a></li>
</ul>

Tool</th>	Legacy tag-based signature (`sha256-<digest>.sig</code>)</th>`	OCI 1.1 referrers (modern Cosign/SBOM/attestations)</th>	Note</th></tr></thead>
`regctl image copy</code></a></td>`	`--digest-tags</code></td>`	`--referrers</code></td>`	only tool here with separate, explicit flags for both schemes</td></tr>
`oras cp -r</code></a></td>`	via `-r</code></td>`	`-r</code> (marked “Preview”)</td>`	`--from/to-distribution-spec</code> handles referrers-tag vs. referrers-API mismatches between registries</td></tr>`
`skopeo copy</code></td>`	opt-in</td>	not supported</td>	needs `use-sigstore-attachments: true</code> under the default-docker</code> key in registries.d</code>, on both source and destination</td></tr>`
Zot registry `sync</code></td>`	`syncLegacyCosignTags</code> (default true</code>)</td>`	only with `preserveDigest: true</code></td>`	without `preserveDigest</code>, Zot re-encodes Docker-format images to OCI on sync, which changes the digest and detaches the signature</td></tr>`
`cosign copy</code></td>`	yes</td>	no</td>	deprecated</strong> as of sigstore/cosign#4681</a> (merged 2026-02-04) — the tool itself now points to `oras copy -r</code> instead</td></tr>`
`crane copy</code></td>`	only incidentally, via `--all-tags</code></td>`	no</td>	plain manifest/layer copier, no signature awareness at all</td></tr>
Harbor replication</td>	per Harbor’s own docs, yes</td>	open gap (goharbor/harbor#23210</a>)</td>	works for the legacy scheme; OCI 1.1 referrers replication is not yet reliable</td></tr> </tbody></table> `regctl</code> is the only tool in this comparison that exposes both signature schemes as distinct, intentional flags rather than as a side effect of copying “everything.” For a registry pair that already speaks the OCI 1.1 referrers API end to end, oras cp -r</code> is the other option worth checking — it’s what the cosign project’s own deprecation notice for cosign copy</code> points to.</p>` Example: mirroring with regctl🔗</a></h2> Here is an example command to mirror k8s-scale-app-rs</code> itself, signature included, using regctl</code>:</p> regctl</span> image</span> copy</span> \</span></span> -</span>-digest-tags</span> -</span>-referrers</span> \</span></span> ghcr.io/git001/k8s-scale-app-rs:v1.0.0</span> \</span></span> my-private-registry.example.com/k8s-scale-app-rs:v1.0.0</span></span></code></pre>Sources🔗</a></h2> sigstore/cosign PR #4681 — “Deprecate cosign copy”</a></li> sigstore/cosign#4335 — Complete OCI 1.1 Referrers API Support Across All Cosign Commands</a></li> sigstore/cosign#4564 — cosign verify fails after cosign copy (JFrog Artifactory)</a></li> podman-container-tools/skopeo#2061 — sigstore signature copying and use-sigstore-attachments</code></a></li> regctl image copy</code> reference</a></li> oras cp</code> command reference</a></li> goharbor/harbor#23210 — OCI 1.1 referrers not replicated</a></li> Zot registry: mirroring/sync documentation</a></li> OpenShift Container Platform 4.18 release notes</a></li> openshift/oc-mirror — signature-verification.md</a></li> </ul>

Alek's Blog - container-registry

Which Tool Mirrors a Cosign-Signed Image into a Private Registry?