How to download a *.sig image?

[Anselmoo]

Dear Cosign-Team,

Can you pull the signed image in general? The point is that it looks confusing if the recommended image cannot be downloaded and not experience users have to first look for the correct and downloadable image.

Do you know a trick to point this out on ghrc.io, please?
If you already discussed that in issues, please forward the ID, I was not able to find it.

Thx

Put:

docker pull ghcr.io/sigstore/cosign/cosign:sha256-5477785587975d48ea22086737584738fa280d9edc744756583d5875a2632d91.sig

Get:

sha256-5477785587975d48ea22086737584738fa280d9edc744756583d5875a2632d91.sig: Pulling from sigstore/cosign/cosign
unsupported media type application/vnd.dev.cosign.simplesigning.v1+json

[hectorj2f]

@Anselmoo Docker pull only pulls container images from a registry. You could try crane pull to get the content of the signature locally.

[Anselmoo]

@hectorj2f thx for the fast answer!!

This might be off a little bit the topic, but how to actually use

ghcr.io/sigstore/cosign/cosign:sha256-5477785587975d48ea22086737584738fa280d9edc744756583d5875a2632d91.sig

to verify the image?