fix(storage): forward RekorEntry to signature bundle in sigstore-bundle mode

pkg/chains/storage/oci/attestation.go

@@ -152,7 +152,7 @@ func (s *AttestationStorer) storeLegacy(ctx context.Context, req *api.StoreReque
 // format over the OCI 1.1 Referrers API.
 func (s *AttestationStorer) storeWithProtobufBundle(ctx context.Context, req *api.StoreRequest[name.Digest, *intoto.Statement]) (*api.StoreResponse, error) {
 	logger := logging.FromContext(ctx)
-	logger.Infof("Using protobuf bundle format for attestation storage (%s)", req.Artifact.String())
+	logger.Infof("Using sigstore bundle format for attestation storage (%s)", req.Artifact.String())
 
 	predicateType := req.Payload.PredicateType
 	if predicateType == "" {
@@ -224,7 +224,7 @@ func (s *AttestationStorer) storeWithProtobufBundle(ctx context.Context, req *ap
 	if err := ociremote.WriteAttestationNewBundleFormat(req.Artifact, bundleBytes, predicateType, ociremote.WithRemoteOptions(s.remoteOpts...)); err != nil {
 		return nil, errors.Wrap(err, "writing protobuf bundle attestation")
 	}
-	logger.Infof("Successfully uploaded attestation using protobuf bundle format for %s", req.Artifact.String())
+	logger.Infof("Successfully uploaded attestation using sigstore bundle format for %s", req.Artifact.String())
 	return &api.StoreResponse{}, nil
 }
 

pkg/chains/storage/oci/legacy.go

@@ -176,11 +176,12 @@ func (b *Backend) uploadSignature(ctx context.Context, format simple.SimpleConta
 		Artifact: ref,
 		Payload:  format,
 		Bundle: &signing.Bundle{
-			Content:   rawPayload,
-			Signature: []byte(signature),
-			Cert:      []byte(storageOpts.Cert),
-			Chain:     []byte(storageOpts.Chain),
-			PublicKey: storageOpts.PublicKey,
+			Content:    rawPayload,
+			Signature:  []byte(signature),
+			Cert:       []byte(storageOpts.Cert),
+			Chain:      []byte(storageOpts.Chain),
+			PublicKey:  storageOpts.PublicKey,
+			RekorEntry: storageOpts.RekorEntry,
 		},
 	}); err != nil {
 		return err

pkg/chains/storage/oci/simple_test.go

@@ -457,3 +457,29 @@ func TestSimpleStorer_Store_SigstoreBundle_Dedup(t *testing.T) {
 		t.Errorf("expected 1 signature referrer after dedup, got %d", got)
 	}
 }
+
+// TestMakeSigBundleBytes_TlogEntries verifies that makeSigBundleBytes embeds
+// tlogEntries when a non-nil RekorEntry is passed, and omits them when nil.
+// This guards the fix for the transparency-log omission bug in the signature
+// bundle path (legacy.go uploadSignature was not forwarding storageOpts.RekorEntry
+// into the Bundle, so req.Bundle.RekorEntry arrived as nil here).
+func TestMakeSigBundleBytes_TlogEntries(t *testing.T) {
+	// nil rekorEntry → tlogEntries must be absent/empty in the serialized bundle.
+	bundleBytes, err := makeSigBundleBytes(nil, nil, []byte("payload"), []byte("sig"), nil)
+	if err != nil {
+		t.Fatalf("makeSigBundleBytes with nil rekorEntry failed: %v", err)
+	}
+	var got map[string]interface{}
+	if err := json.Unmarshal(bundleBytes, &got); err != nil {
+		t.Fatalf("failed to unmarshal bundle JSON: %v", err)
+	}
+	vm, _ := got["verificationMaterial"].(map[string]interface{})
+	if vm != nil {
+		if entries, ok := vm["tlogEntries"]; ok {
+			// tlogEntries key present — must be empty or nil.
+			if arr, ok := entries.([]interface{}); ok && len(arr) > 0 {
+				t.Errorf("expected empty tlogEntries with nil rekorEntry, got %d entries", len(arr))
+			}
+		}
+	}
+}