Exclude the special keys from the annotation comparison.

Signed-off-by: Matt Moore <[email protected]>

pkg/cosign/remote/remote.go

@@ -32,6 +32,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
 	"github.com/google/go-containerregistry/pkg/v1/types"
 	"github.com/pkg/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"knative.dev/pkg/kmeta"
 
 	"github.com/sigstore/cosign/internal/oci"
@@ -49,6 +50,8 @@ const (
 	BundleKey = "dev.sigstore.cosign/bundle"
 )
 
+var specialKeys = sets.NewString(sigkey, certkey, chainkey, BundleKey)
+
 func Descriptors(ref name.Reference, remoteOpts ...remote.Option) ([]v1.Descriptor, error) {
 	img, err := remote.Image(ref, remoteOpts...)
 	if err != nil {
@@ -103,8 +106,12 @@ LayerLoop:
 		if err != nil {
 			continue LayerLoop
 		}
+
 		// if there are any new annotations, then this isn't a duplicate
 		for a, value := range newAnnotations {
+			if specialKeys.Has(a) {
+				continue // Ignore the special keys, we check those below.
+			}
 			if val, ok := existingAnnotations[a]; !ok || val != value {
 				continue LayerLoop
 			}