IssueTracker

Problem

When running the cloudbuild.yaml below, I'm running into the following error:

ERROR: (gcloud.beta.container.binauthz.attestations.sign-and-create) A Docker registry domain must be specified.

What I expected

The provided image should have been attested

Steps to reproduce

gcloud builds submit . --config cloudbuild.yaml

The same can be observed when following the official tutorial (i.e. running the gcloud container binauthz attestations create command)

What I've found

The problem is resolved when adding the image's digest to --artifact-url (i.e. ${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/hello-world/nginx@sha256:abc123). However, this is obviously not practical in a build pipeline because I don't know the digest beforehand.

Am I supposed to retrieve the digest programmatically?

Other information

cloudbuild.yaml:

steps:
  - id: 'pull-image'
    name: 'gcr.io/cloud-builders/docker'
    args: ['pull', 'nginx']
  - id: 'tag-image'
    name: 'gcr.io/cloud-builders/docker'
    args: ['tag', 'nginx', '${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/hello-world/nginx']
  - id: 'push-image'
    name: 'gcr.io/cloud-builders/docker'
    args: ['push', '${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/hello-world/nginx']
  - id: 'create-attestation'
    name: 'gcr.io/${PROJECT_ID}/binauthz-attestation:latest'
    args:
      - '--artifact-url'
      - '${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/hello-world/nginx:latest'
      - '--attestor'
      - 'projects/${PROJECT_ID}/attestors/${_ATTESTOR_NAME}'
      - '--keyversion'
      - 'projects/${PROJECT_ID}/locations/${_KMS_KEY_LOCATION}/keyRings/${_KMS_KEYRING_NAME}/cryptoKeys/${_KMS_KEY_NAME}/cryptoKeyVersions/${_KMS_KEY_VERSION}'
substitutions:
  _LOCATION: 'us-central1
  _ATTESTOR_NAME: 'my-attestor'
  _KMS_KEY_LOCATION: 'global'
  _KMS_KEYRING_NAME: 'my-binauthz-keyring'
  _KMS_KEY_NAME: 'my-binauthz-kms-key-name'
  _KMS_KEY_VERSION: '1'