'docker trust sign' does not work with manifest lists

[rn]

I created/pushed a new manifest list (using some LinuxKit images/repo for which signing is already set up:

$ docker manifest create linuxkit/auditd:test-sign \
    linuxkit/auditd:6ea41e1a0c3c0396703aa888f23e5dafcc4fd2bd-arm64 \
    linuxkit/auditd:6ea41e1a0c3c0396703aa888f23e5dafcc4fd2bd-amd64
$ docker manifest push linuxkit/auditd:test-sign

The manifest is available and inspectable.

The, I attempt to sign the manifest list:

$ docker trust sign linuxkit/auditd:test-sign
Error: No such image: linuxkit/auditd:test-sign

[dnephin]

cc @n4ss do you know who can look into this?

[eiais]

This doesn't work for two reasons.

checkLocalImageExistence only returns local Images and doesn't check if a manifest is local. If that was modified to be checkLocalExistence for images and manifests it would break in sign.go on line 93 which calls image.TrustedPush.

If a manifest was signed first with notary then multisigning would work with trust sign.
AFAIK there isn't an equivalent to image.TrustedPush for manifests