COSIGN_REPOSITORY is ignored for legacy-bundle OCI 1.1 signatures

[reneleonhardt]

Description

When COSIGN_REPOSITORY is set, cosign sign --registry-referrers-mode=oci-1-1 announces the target repository but publishes the signature layers, config, and referrer manifest to the source repository.

$ COSIGN_PASSWORD=repro COSIGN_EXPERIMENTAL=1 COSIGN_REPOSITORY=127.0.0.1:5007/target \
    ./cosign sign --yes --key cosign.key --signing-config signing-config.json --bundle repro.bundle --registry-referrers-mode=oci-1-1 \
    --new-bundle-format=false --allow-insecure-registry 127.0.0.1:5007/source@sha256:e7a1a92a5bfeee40966aea60f0796b0e7917cc35591542701834f03a68fa3d18
Signing artifact...
Wrote bundle to file repro.bundle
Pushing signature to: 127.0.0.1:5007/target
Uploading signature for [127.0.0.1:5007/source@sha256:e7a1a92a5bfeee40966aea60f0796b0e7917cc35591542701834f03a68fa3d18] to [127.0.0.1:5007/source@sha256:<signature-manifest-digest>] ...

The subject should still be resolved from 127.0.0.1:5007/source, but all signature artifacts should be published to 127.0.0.1:5007/target. Without COSIGN_REPOSITORY, publication should remain in the source repository.

This is distinct from #4464, which fixed repository redirection for the default new-bundle writer. The legacy-bundle OCI 1.1 signature writer remains affected.

A focused fix with regression coverage is complete and ready for a pull request.

Version

v3.0.0-20260731151431-83d9ec8f4bdb go1.26.5 darwin/arm64