feat: embed Rekor bundle in OCI attestation layer annotations

docs/sigstore.md

@@ -35,6 +35,16 @@ Right now, Chains default to storing entries in the public Rekor instance
 kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"transparency.url": "<YOUR URL>"}}'
 ```
 
+### Offline Verification with Rekor Bundle
+
+When transparency is enabled and the OCI storage backend is used, Chains automatically embeds the Rekor bundle (`dev.sigstore.cosign/bundle`) in the OCI attestation layer annotations. This enables offline verification of transparency log entries without querying the Rekor server.
+
+This applies to **attestations only** (in-toto / DSSE-wrapped SLSA provenance stored via `cosign verify-attestation`). OCI image signatures using the simplesigning format do not currently embed the bundle, so `cosign verify` will not find it.
+
+No additional configuration is required — the bundle is embedded automatically when `transparency.enabled` is set to `true` and attestations are stored in an OCI registry.
+
+> **Note:** If the Rekor upload fails (e.g. due to a transient network error), attestation storage still proceeds but the bundle annotation will be absent. Consumers that rely on the bundle for offline verification will silently receive an attestation without it.
+
 ## Keyless Signing Mode
 
 Chains also supports a keyless signing mode with

pkg/chains/signing.go

@@ -21,6 +21,7 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	intoto "github.com/in-toto/attestation/go/v1"
+	cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 	"github.com/tektoncd/chains/pkg/artifacts"
 	"github.com/tektoncd/chains/pkg/chains/annotations"
 	"github.com/tektoncd/chains/pkg/chains/formats"
@@ -142,6 +143,18 @@ func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject)
 		// Extract all the "things" to be signed.
 		// We might have a few of each type (several binaries, or images)
 		objects := signableType.ExtractObjects(ctx, tektonObj)
+
+		// Create the Rekor client once before iterating over objects since it is
+		// stateless and config-driven.
+		var tlogClient rekorClient
+		if shouldUploadTlog(cfg, tektonObj) {
+			var err error
+			tlogClient, err = getRekor(cfg.Transparency.URL)
+			if err != nil {
+				return err
+			}
+		}
+
 		// Go through each object one at a time.
 		for _, obj := range objects {
 
@@ -186,6 +199,29 @@ func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject)
 			}
 			measureMetrics(ctx, metrics.SignedMessagesCount, o.Recorder)
 
+			// Upload to Rekor before storage so the bundle is available for OCI attestation annotations.
+			// On upload failure, storage proceeds but the bundle annotation will be absent —
+			// consumers that rely on the bundle for offline verification will get an attestation without it.
+			var rekorBundle *cbundle.RekorBundle
+			if tlogClient != nil {
+				entry, err := tlogClient.UploadTlog(ctx, signer, signature, rawPayload, signer.Cert(), string(payloadFormat))
+				if err != nil {
+					logger.Warnf("error uploading entry to tlog: %v", err)
+					o.recordError(ctx, signableType, metrics.TlogError)
+					merr = multierror.Append(merr, err)
+				} else {
+					logger.Infof("Uploaded entry to %s with index %d", cfg.Transparency.URL, *entry.LogIndex)
+					extraAnnotations[annotations.ChainsTransparencyAnnotation] = fmt.Sprintf("%s/api/v1/log/entries?logIndex=%d", cfg.Transparency.URL, *entry.LogIndex)
+					rekorBundle = cbundle.EntryToBundle(entry)
+					if rekorBundle != nil {
+						logger.Infof("Resolved Rekor bundle for offline verification (logIndex: %d)", rekorBundle.Payload.LogIndex)
+					} else {
+						logger.Warn("Rekor entry missing verification data, skipping bundle for offline verification")
+					}
+					measureMetrics(ctx, metrics.PayloadUploadedCount, o.Recorder)
+				}
+			}
+
 			// Now store those!
 			for _, backend := range sets.List[string](signableType.StorageBackend(cfg)) {
 				b, ok := o.Backends[backend]
@@ -203,6 +239,7 @@ func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject)
 					Cert:          signer.Cert(),
 					Chain:         signer.Chain(),
 					PayloadFormat: payloadFormat,
+					RekorBundle:   rekorBundle,
 				}
 				if err := b.StorePayload(ctx, tektonObj, rawPayload, string(signature), storageOpts); err != nil {
 					logger.Error(err)
@@ -213,24 +250,6 @@ func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject)
 				}
 			}
 
-			if shouldUploadTlog(cfg, tektonObj) {
-				rekorClient, err := getRekor(cfg.Transparency.URL)
-				if err != nil {
-					return err
-				}
-
-				entry, err := rekorClient.UploadTlog(ctx, signer, signature, rawPayload, signer.Cert(), string(payloadFormat))
-				if err != nil {
-					logger.Warnf("error uploading entry to tlog: %v", err)
-					o.recordError(ctx, signableType, metrics.TlogError)
-					merr = multierror.Append(merr, err)
-				} else {
-					logger.Infof("Uploaded entry to %s with index %d", cfg.Transparency.URL, *entry.LogIndex)
-					extraAnnotations[annotations.ChainsTransparencyAnnotation] = fmt.Sprintf("%s/api/v1/log/entries?logIndex=%d", cfg.Transparency.URL, *entry.LogIndex)
-					measureMetrics(ctx, metrics.PayloadUploadedCount, o.Recorder)
-				}
-			}
-
 		}
 		if merr.ErrorOrNil() != nil {
 			if retryErr := annotations.HandleRetry(ctx, tektonObj, o.Pipelineclientset, extraAnnotations); retryErr != nil {

pkg/chains/signing/iface.go

@@ -14,6 +14,7 @@ limitations under the License.
 package signing
 
 import (
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
@@ -39,6 +40,8 @@ type Bundle struct {
 	Signature []byte
 	// Cert is an optional PEM encoded x509 certificate, if one was used for signing.
 	Cert []byte
-	// Cert is an optional PEM encoded x509 certificate chain, if one was used for signing.
+	// Chain is an optional PEM encoded x509 certificate chain, if one was used for signing.
 	Chain []byte
+	// RekorBundle is an optional Rekor transparency log bundle, populated when transparency is enabled.
+	RekorBundle *bundle.RekorBundle
 }