main.go:74: error during command execution: signing <registry>/<app>@s<digest>: PUT https://***att: MANIFEST_INVALID: manifest invalid; map[description:Could not locate artifact '***.att/manifest.json'

[blueacidification]

Description

[<!--Tell us about the bug. What went wrong? How can we reproduce it? What should the correct behavior be?

    cosign attest --yes --predicate sbom.spdx.json --type spdx --key cosign.key ${{ inputs.DOCKER_REGISTRY }}/${{ inputs.APP_NAME }}:${{ inputs.IMAGE_TAG }}

    cosign attest --yes --predicate provenance.json --type slsaprovenance --key cosign.key ${{ inputs.DOCKER_REGISTRY }}/${{ inputs.APP_NAME }}:${{ inputs.IMAGE_TAG }}

This only shows for predicate provenance.json, is this because the registry is internal to my company and not public ? -->](main.go:74: error during command execution: signing registry>/<app>@s<digest: PUT https://***att: MANIFEST_INVALID: manifest invalid; map[description:Could not locate artifact '***.att/manifest.json'.])

Version

2.2.4

[blueacidification]

If you have a private registry, make sure to get credentials that have overwrite permissions.