Repository: sigstore/cosign (go)

Issue:
"Created" date for signature is always Dec 31, 0
When signing images and pushing them to Google Cloud Registry, the signature's "Created" date is always Dec 31, 0. 
I would have expected the "Created" date for the signature to be the date the container was signed. 

`printenv GCR_ACCOUNT | docker login -u _json_key --password-stdin gcr.io`
`cosign sign -key cosign.key $NAMESPACE:$version`



Pull request description:
Resolves #522 set Created date to time of execution
#### Summary

This commit sets the Created date of the signature to the date of execution of the signing action.

#### Release Note

`-changed: Signatures do now use the created timestamp based on the local time of signing`

#### Documentation

`n/a`

Patch:
diff --git a/pkg/oci/mutate/signatures.go b/pkg/oci/mutate/signatures.go
index 53f750d9..f5c24e92 100644
--- a/pkg/oci/mutate/signatures.go
+++ b/pkg/oci/mutate/signatures.go
@@ -16,6 +16,8 @@
 package mutate
 
 import (
+	"time"
+
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
@@ -36,10 +38,18 @@ func AppendSignatures(base oci.Signatures, sigs ...oci.Signature) (oci.Signature
 			Annotations: ann,
 		})
 	}
+
 	img, err := mutate.Append(base, adds...)
 	if err != nil {
 		return nil, err
 	}
+
+	// Set the Created date to time of execution
+	img, err = mutate.CreatedAt(img, v1.Time{Time: time.Now()})
+	if err != nil {
+		return nil, err
+	}
+
 	return &sigAppender{
 		Image: img,
 		base:  base,
diff --git a/pkg/oci/static/file.go b/pkg/oci/static/file.go
index 270b5a6b..d1d895bd 100644
--- a/pkg/oci/static/file.go
+++ b/pkg/oci/static/file.go
@@ -17,6 +17,7 @@ package static
 
 import (
 	"io"
+	"time"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
@@ -44,6 +45,12 @@ func NewFile(payload []byte, opts ...Option) (oci.File, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	// Set the Created date to time of execution
+	img, err = mutate.CreatedAt(img, v1.Time{Time: time.Now()})
+	if err != nil {
+		return nil, err
+	}
 	return &file{
 		SignedImage: signed.Image(img),
 		layer:       layer,


Test patch:
diff --git a/pkg/oci/mutate/signatures_test.go b/pkg/oci/mutate/signatures_test.go
index 14978ce7..c1f0de9a 100644
--- a/pkg/oci/mutate/signatures_test.go
+++ b/pkg/oci/mutate/signatures_test.go
@@ -70,4 +70,10 @@ func TestAppendSignatures(t *testing.T) {
 	} else if got, want := len(sl), 3; got != want {
 		t.Errorf("len(Get()) = %d, wanted %d", got, want)
 	}
+
+	if testCfg, err := threeSig.ConfigFile(); err != nil {
+		t.Fatalf("ConfigFile() = %v", err)
+	} else if testCfg.Created.Time.IsZero() {
+		t.Errorf("Date of Signature was Zero")
+	}
 }
diff --git a/pkg/oci/static/file_test.go b/pkg/oci/static/file_test.go
index 8c074fbc..c652a7a3 100644
--- a/pkg/oci/static/file_test.go
+++ b/pkg/oci/static/file_test.go
@@ -120,4 +120,14 @@ func TestNewFile(t *testing.T) {
 			t.Errorf("Payload() = %s, wanted %s", got, want)
 		}
 	})
+
+	t.Run("check date", func(t *testing.T) {
+		fileCfg, err := file.ConfigFile()
+		if err != nil {
+			t.Fatalf("ConfigFile() = %v", err)
+		}
+		if fileCfg.Created.Time.IsZero() {
+			t.Errorf("Date of Signature was Zero")
+		}
+	})
 }