Manifest lists are not signed

[lbussell]

Problem

Related: #1376

Container image signing is implemented in the pipeline's Sign stage, which runs after the Post_Build stage. However, manifest lists (multi-arch image indexes) are not created until the Publish stage - which runs after the Sign stage. This means manifest lists are never signed.

The signing infrastructure already supports manifest lists - SignImagesCommand signs all digests returned by GetAllDigests(), which includes manifest list digests when they exist in image-info.json. The problem is that at sign time, manifest list digests have not been populated yet because the publishManifest command hasn't run.

Current Pipeline Flow

1. Build - creates platform images, produces per-job image-info fragments
2. Post_Build - merges image-info fragments into a single file
3. Sign - signs all digests in image-info (platform images only - no manifest list digests exist yet)
4. Test - tests images
5. Publish - copies images, creates manifest lists here (too late to sign)

Proposed Solution

Move manifest list creation from the Publish stage to the Post_Build stage so that manifest list digests exist in image-info.json before the Sign stage runs. See #2002 for details.

[lbussell]

This is fixed with #2038. ImageBuilder's manifest lists are now signed. Example:

image=mcr.microsoft.com/dotnet-buildtools/image-builder:2940448
digest=$(oras manifest fetch --descriptor $image | jq -r '.digest')
ref=mcr.microsoft.com/dotnet-buildtools/image-builder@$digest

% manifest=$(oras manifest fetch $ref) && echo "Image Ref: $ref" && echo "Media type: $(echo $manifest | jq '.mediaType')" && echo "Number of manifests: $(echo $manifest | jq '.manifests | length')" && echo "Platforms:\n$(echo $manifest | jq '.manifests[].platform | "\(.os)/\(.architecture)\(.variant // "")"')"
Image Ref: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:597fb81401b176f1e20b6a27f1719ab1d2b52c86fd8e9c6c466ae0244ed4530b
Media type: "application/vnd.docker.distribution.manifest.list.v2+json"
Number of manifests: 5
Platforms:
"linux/amd64"
"linux/arm64"
"windows/amd64"
"windows/amd64"
"windows/amd64"

% notation inspect $ref
Inspecting all signatures for signed artifact
mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:597fb81401b176f1e20b6a27f1719ab1d2b52c86fd8e9c6c466ae0244ed4530b
└── application/vnd.cncf.notary.signature
    └── sha256:1adb2e50664d4e73df6650e3eb227fab94205adf12604488f77cb53b8c90c708
        ├── media type: application/cose
        ├── signature algorithm: RSASSA-PSS-SHA-384
        ├── signed attributes
        │   ├── signingScheme: notary.x509
        │   ├── signingTime: Tue Mar 31 10:19:11 2026
        │   └── 34: [-16 [132 129 62 156 130 254 138 189 8 224 230 250 33 183 27 37 178 86 210 201 254 195 142 130 22 232 191 72 84 48 8 201]]
        ├── user defined attributes
        │   └── (empty)
        ├── unsigned attributes
        │   └── timestamp signature
        │       ├── timestamp: [Tue Mar 31 17:19:11 2026, Tue Mar 31 17:19:12 2026]
        │       └── certificates
        │           ├── SHA256 fingerprint: b1b695cc5c488b273aea33bedea78ad3370acc3a3ea0a5637d859be98f940551
        │           │   ├── issued to: CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
        │           │   ├── issued by: CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
        │           │   └── expiry: Fri Nov 13 18:48:33 2026
        │           └── SHA256 fingerprint: ebec1edd9e140d9c105cc62b15a915c5443ddc514a35e5773c09afb0274c7ba5
        │               ├── issued to: CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
        │               ├── issued by: CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
        │               └── expiry: Mon Sep 30 18:32:25 2030
        ├── certificates
        │   ├── SHA256 fingerprint: 84813e9c82fe8abd08e0e6fa21b71b25b256d2c9fec38e8216e8bf48543008c9
        │   │   ├── issued to: CN=Microsoft SCD Products RSA Signing,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
        │   │   ├── issued by: CN=Microsoft SCD Products RSA CA,O=Microsoft Corporation,C=US
        │   │   └── expiry: Tue Nov 10 19:27:20 2026
        │   ├── SHA256 fingerprint: 9b1894f223d934cbd6575af3c6e1f6096b9221a7da132185f5a5cdc92235b5dc
        │   │   ├── issued to: CN=Microsoft SCD Products RSA CA,O=Microsoft Corporation,C=US
        │   │   ├── issued by: CN=Microsoft Supply Chain RSA Root CA 2022,O=Microsoft Corporation,C=US
        │   │   └── expiry: Mon Feb 17 00:55:23 2042
        │   └── SHA256 fingerprint: 23ffe2b8bdb9a1711515d4cffda04bc7f793d513c76c243f1020507d8669b7db
        │       ├── issued to: CN=Microsoft Supply Chain RSA Root CA 2022,O=Microsoft Corporation,C=US
        │       ├── issued by: CN=Microsoft Supply Chain RSA Root CA 2022,O=Microsoft Corporation,C=US
        │       └── expiry: Sun Feb 17 00:21:09 2047
        └── signed artifact
            ├── media type: application/vnd.docker.distribution.manifest.list.v2+json
            ├── digest: sha256:597fb81401b176f1e20b6a27f1719ab1d2b52c86fd8e9c6c466ae0244ed4530b
            └── size: 1811

$ notation verify $ref
Successfully verified signature for mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:597fb81401b176f1e20b6a27f1719ab1d2b52c86fd8e9c6c466ae0244ed4530b