Hide "sha256-" artefacts by default

[pedroosorio]

Artifacts that start with "sha256-" (signatures, mostly) clutter heavily the UI. It would be nice if those could be hidden by default and only shown when toggled.

[wy65701436]

can you explain the issue in details?

[pedroosorio]

Hi ! Whenever we sign an artifact, be it an image, oci index or sbom, we get a signature artifact too, those of which the tags start with "sha256-....". That really clutters the UI, as you cna see in the screenshot, making actual artifacts hard to find (you need to scroll through pages)

[wy65701436]

Some background: Harbor already handles the common case. Cosign signatures pushed as sha256-<digest>.sig tags are converted into accessories and shown nested under the subject artifact — they should not appear as standalone rows in the artifact list. The same applies to signatures/SBOMs pushed via the OCI referrers API.

So if you're seeing sha256-* artifacts cluttering the list, they're likely tags that Harbor doesn't recognize as accessories. From Harbor's perspective these are ordinary artifacts pushed by your OCI client — there's no reliable signal telling us they're auxiliary

Could you share:

1. An example of the artifact names/tags you'd like hidden, and
2. Which client/tool pushed them (cosign version, etc.)?

[pedroosorio]

Example (you can poke around in that repo, its public). These were signed with notation :

$ notation version
Notation - a tool to sign and verify artifacts.

Version:     1.2.0
Go version:  go1.23.0
Git commit:  4700ad6f1bef13e411772d7ae4399f891fc3a6ae

####################### OCI INDEX #######################
$ regctl manifest get harbor.skao.int/production/ska-base:1.0.0
Name:        harbor.skao.int/production/ska-base:1.0.0
MediaType:   application/vnd.oci.image.index.v1+json
Digest:      sha256:1c353bf1d87c97e83bb22468a0e9fb899ababbab087790b1123114299f3ee259

Manifests:

  Name:      harbor.skao.int/production/ska-base:1.0.0@sha256:6ea8105bf4bc5c85ed68b17e1dd8b9456708f021ada4b6acc606a9e2b61021af
  Digest:    sha256:6ea8105bf4bc5c85ed68b17e1dd8b9456708f021ada4b6acc606a9e2b61021af
  MediaType: application/vnd.oci.image.manifest.v1+json
  Platform:  linux/amd64

  Name:      harbor.skao.int/production/ska-base:1.0.0@sha256:0674dd7ef4fa1f25ddab9c9b082146621ea8f35ebcfaa2be0905a7d6149207ee
  Digest:    sha256:0674dd7ef4fa1f25ddab9c9b082146621ea8f35ebcfaa2be0905a7d6149207ee
  MediaType: application/vnd.oci.image.manifest.v1+json
  Platform:  linux/arm64

$ regctl artifact list harbor.skao.int/production/ska-base:1.0.0
Subject:                                      harbor.skao.int/production/ska-base@sha256:1c353bf1d87c97e83bb22468a0e9fb899ababbab087790b1123114299f3ee259

Referrers:

  Name:                                       harbor.skao.int/production/ska-base@sha256:01c8b0804afae70e48dc02cd09033a049f3eb7c7c70a2dad362e8d0f19e9a21c
  Digest:                                     sha256:01c8b0804afae70e48dc02cd09033a049f3eb7c7c70a2dad362e8d0f19e9a21c
  MediaType:                                  application/vnd.oci.image.manifest.v1+json
  ArtifactType:                               application/vnd.cncf.notary.signature
  Annotations:
    io.cncf.notary.x509chain.thumbprint#S256: ["d3eeb5fc53208619c727624c1fa1d12cc54a668d998c6685a6d4c9a0d8c98734","4adeadfc579ebb7ef6f47c1785682204bc2edf1f4bee7b5c7b38f838ff7f8164","548c22623068fc38810a384b5049eac6a1a2c678d96e79011fcbfa1aed18503d"]
    org.opencontainers.image.created:         2026-08-03T14:06:48Z
####################### OCI INDEX #######################

####################### OCI IMAGE (linux/amd64 platform) #######################
$ regctl artifact list harbor.skao.int/production/ska-base@sha256:6ea8105bf4bc5c85ed68b17e1dd8b9456708f021ada4b6acc606a9e2b61021af
Subject:                                      harbor.skao.int/production/ska-base@sha256:6ea8105bf4bc5c85ed68b17e1dd8b9456708f021ada4b6acc606a9e2b61021af

Referrers:

  Name:                                       harbor.skao.int/production/ska-base@sha256:c54e0db5efe3dd99e186f476ec667703d3bf82b7d2188b20416caad217a92d3f
  Digest:                                     sha256:c54e0db5efe3dd99e186f476ec667703d3bf82b7d2188b20416caad217a92d3f
  MediaType:                                  application/vnd.oci.image.manifest.v1+json
  ArtifactType:                               application/vnd.goharbor.harbor.sbom.v1
  Annotations:
    org.opencontainers.artifact.created:      2026-07-23T17:15:52Z
    org.opencontainers.artifact.description:  SPDX JSON SBOM
    created:                                  2026-07-23T17:15:52Z
    created-by:                               Harbor

  Name:                                       harbor.skao.int/production/ska-base@sha256:9c8aa5ff197d6d0f3c6aa1431050d44f6677df312772c5b9e7adbaf19d51962d
  Digest:                                     sha256:9c8aa5ff197d6d0f3c6aa1431050d44f6677df312772c5b9e7adbaf19d51962d
  MediaType:                                  application/vnd.oci.image.manifest.v1+json
  ArtifactType:                               application/vnd.cncf.notary.signature
  Annotations:
    io.cncf.notary.x509chain.thumbprint#S256: ["d3eeb5fc53208619c727624c1fa1d12cc54a668d998c6685a6d4c9a0d8c98734","4adeadfc579ebb7ef6f47c1785682204bc2edf1f4bee7b5c7b38f838ff7f8164","548c22623068fc38810a384b5049eac6a1a2c678d96e79011fcbfa1aed18503d"]
    org.opencontainers.image.created:         2026-08-03T14:07:02
####################### OCI IMAGE (linux/amd64 platform) #######################

####################### SBOM #######################
$ regctl artifact list harbor.skao.int/production/ska-base@sha256:c54e0db5efe3dd99e186f476ec667703d3bf82b7d2188b20416caad217a92d3f
Subject:                                      harbor.skao.int/production/ska-base@sha256:c54e0db5efe3dd99e186f476ec667703d3bf82b7d2188b20416caad217a92d3f

Referrers:

  Name:                                       harbor.skao.int/production/ska-base@sha256:55ade94d3397499ccc02e48ae0670ad3ad439dab4b84979d167a5ba9ea4f924c
  Digest:                                     sha256:55ade94d3397499ccc02e48ae0670ad3ad439dab4b84979d167a5ba9ea4f924c
  MediaType:                                  application/vnd.oci.image.manifest.v1+json
  ArtifactType:                               application/vnd.cncf.notary.signature
  Annotations:
    io.cncf.notary.x509chain.thumbprint#S256: ["d3eeb5fc53208619c727624c1fa1d12cc54a668d998c6685a6d4c9a0d8c98734","4adeadfc579ebb7ef6f47c1785682204bc2edf1f4bee7b5c7b38f838ff7f8164","548c22623068fc38810a384b5049eac6a1a2c678d96e79011fcbfa1aed18503d"]
    org.opencontainers.image.created:         2026-08-03T14:37:57Z
####################### SBOM #######################

Until here, all good. Now notice:

harbor.skao.int/production/ska-base@sha256:1c353bf1d87c97e83bb22468a0e9fb899ababbab087790b1123114299f3ee259
└── application/vnd.cncf.notary.signature
    └── sha256:01c8b0804afae70e48dc02cd09033a049f3eb7c7c70a2dad362e8d0f19e9a21c
        ├── media type: application/jose+json
        ├── signature algorithm: RSASSA-PSS-SHA-512
        ├── signed attributes
        │   ├── signingTime: Mon Aug  3 15:06:48 2026
        │   └── signingScheme: notary.x509
        ├── user defined attributes
        │   └── (empty)
        ├── unsigned attributes
        │   ├── timestamp signature
        │   │   ├── timestamp: [Mon Aug  3 14:06:46 2026, Mon Aug  3 14:06:46 2026]
        │   │   └── certificates
        │   │       ├── SHA256 fingerprint: fc0cc02a3e9017dd5fbadb00ff0012a6eb628e9dc5eeb69c41a5bce0abca8899
        │   │       │   ├── issued to: CN=DigiCert SHA512 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
        │   │       │   ├── issued by: CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
        │   │       │   └── expiry: Wed Sep  3 23:59:59 2036
        │   │       ├── SHA256 fingerprint: ca0b1554ecd901ea19dcad8749e9f2648c8d6dfcea1add9d2c2109415bb82ccd
        │   │       │   ├── issued to: CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
        │   │       │   ├── issued by: CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
        │   │       │   └── expiry: Thu Jan 14 23:59:59 2038
        │   │       └── SHA256 fingerprint: 33846b545a49c9be4903c60e01713c1bd4e4ef31ea65cd95d69e62794f30b941
        │   │           ├── issued to: CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
        │   │           ├── issued by: CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
        │   │           └── expiry: Sun Nov  9 23:59:59 2031
        │   └── signingAgent: notation-go/1.2.0
        ├── certificates
        │   ├── SHA256 fingerprint: d3eeb5fc53208619c727624c1fa1d12cc54a668d998c6685a6d4c9a0d8c98734
        │   │   ├── issued to: CN=ca@skao.int,O=SKAO,L=Cheshire,ST=England,C=UK
        │   │   ├── issued by: CN=SKAO OCI Intermediate Certificate Authority,OU=SKAO,O=SKAO,ST=England,C=UK,1.2.840.113549.1.9.1=#0c12656e7175697269657340736b616f2e696e74
        │   │   └── expiry: Tue Aug  4 14:05:33 2026
        │   ├── SHA256 fingerprint: 4adeadfc579ebb7ef6f47c1785682204bc2edf1f4bee7b5c7b38f838ff7f8164
        │   │   ├── issued to: CN=SKAO OCI Intermediate Certificate Authority,OU=SKAO,O=SKAO,ST=England,C=UK,1.2.840.113549.1.9.1=#0c12656e7175697269657340736b616f2e696e74
        │   │   ├── issued by: CN=SKAO Certificate Authority,OU=SKAO,O=SKAO,L=Cheshire,ST=England,C=UK,1.2.840.113549.1.9.1=#0c12656e7175697269657340736b616f2e696e74
        │   │   └── expiry: Fri Dec 16 09:22:27 2033
        │   └── SHA256 fingerprint: 548c22623068fc38810a384b5049eac6a1a2c678d96e79011fcbfa1aed18503d
        │       ├── issued to: CN=SKAO Certificate Authority,OU=SKAO,O=SKAO,L=Cheshire,ST=England,C=UK,1.2.840.113549.1.9.1=#0c12656e7175697269657340736b616f2e696e74
        │       ├── issued by: CN=SKAO Certificate Authority,OU=SKAO,O=SKAO,L=Cheshire,ST=England,C=UK,1.2.840.113549.1.9.1=#0c12656e7175697269657340736b616f2e696e74
        │       └── expiry: Thu Nov 25 09:16:22 2123
        └── signed artifact
            ├── media type: application/vnd.oci.image.index.v1+json
            ├── digest: sha256:1c353bf1d87c97e83bb22468a0e9fb899ababbab087790b1123114299f3ee259
            └── size: 645

$ regctl manifest get harbor.skao.int/production/ska-base@sha256:01c8b0804afae70e48dc02cd09033a049f3eb7c7c70a2dad362e8d0f19e9a21c
Name:                                       harbor.skao.int/production/ska-base@sha256:01c8b0804afae70e48dc02cd09033a049f3eb7c7c70a2dad362e8d0f19e9a21c
MediaType:                                  application/vnd.oci.image.manifest.v1+json
Digest:                                     sha256:01c8b0804afae70e48dc02cd09033a049f3eb7c7c70a2dad362e8d0f19e9a21c
Annotations:
  io.cncf.notary.x509chain.thumbprint#S256: ["d3eeb5fc53208619c727624c1fa1d12cc54a668d998c6685a6d4c9a0d8c98734","4adeadfc579ebb7ef6f47c1785682204bc2edf1f4bee7b5c7b38f838ff7f8164","548c22623068fc38810a384b5049eac6a1a2c678d96e79011fcbfa1aed18503d"]
  org.opencontainers.image.created:         2026-08-03T14:06:48Z
Total Size:                                 15.787kB

Config:
  Digest:                                   sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
  MediaType:                                application/vnd.cncf.notary.signature
  Size:                                     2B

Layers:

  Digest:                                   sha256:5ee593bdbedea72aea6e3742ba63457bb70c65a0ade2fbb5a243a314a765a6ec
  MediaType:                                application/jose+json
  Size:                                     15787B

Subject:
  Digest:                                   sha256:1c353bf1d87c97e83bb22468a0e9fb899ababbab087790b1123114299f3ee259
  MediaType:                                application/vnd.oci.image.index.v1+json

$ regctl manifest get harbor.skao.int/production/ska-base:sha256-7323356f9cc719c9153cf6aec68f34cbc3b143f29e75873a6c03223d59697fc2                                                                                                               
Name:                                         harbor.skao.int/production/ska-base:sha256-7323356f9cc719c9153cf6aec68f34cbc3b143f29e75873a6c03223d59697fc2
MediaType:                                    application/vnd.oci.image.index.v1+json
Digest:                                       sha256:29652a9af9dc5121b6f91996ee8f65743c4d08ba25dac4ebc0e1ee8cefa2eaca

Manifests:

  Name:                                       harbor.skao.int/production/ska-base:sha256-7323356f9cc719c9153cf6aec68f34cbc3b143f29e75873a6c03223d59697fc2@sha256:d0a8b0b65b7b48b5471755076fadffbbc7daa428e01ee775a190d86e9609a78c
  Digest:                                     sha256:d0a8b0b65b7b48b5471755076fadffbbc7daa428e01ee775a190d86e9609a78c
  MediaType:                                  application/vnd.oci.image.manifest.v1+json
  ArtifactType:                               application/vnd.cncf.notary.signature
  Annotations:
    io.cncf.notary.x509chain.thumbprint#S256: ["3b7a9134fcfb67d0bbfa45c5bfc1b8995db4d61b5d807d89983a662ae20e77c6","4adeadfc579ebb7ef6f47c1785682204bc2edf1f4bee7b5c7b38f838ff7f8164","548c22623068fc38810a384b5049eac6a1a2c678d96e79011fcbfa1aed18503d"]
    org.opencontainers.image.created:         2026-08-03T19:47:28Z

Artifacts look good with all the referrers and whatnot, but then are these.

[wy65701436]

thanks @pedroosorio for providing the examples, would you mind to push the artifact into our demo env? So that, I will have a look at them, thanks.

https://demo.goharbor.io/harbor/projects/7300/repositories