Index: golang-github-containers-image/signature/fulcio_cert.go
===================================================================
--- golang-github-containers-image.orig/signature/fulcio_cert.go
+++ golang-github-containers-image/signature/fulcio_cert.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/signature/internal/rekor_set.go
===================================================================
--- golang-github-containers-image.orig/signature/internal/rekor_set.go
+++ golang-github-containers-image/signature/internal/rekor_set.go
@@ -1,3 +1,5 @@
+//go:build debian_no_rekor
+// +build debian_no_rekor
 package internal
 
 import (
Index: golang-github-containers-image/signature/policy_eval_sigstore.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_eval_sigstore.go
+++ golang-github-containers-image/signature/policy_eval_sigstore.go
@@ -5,8 +5,6 @@ package signature
 import (
 	"context"
 	"crypto"
-	"crypto/ecdsa"
-	"crypto/x509"
 	"errors"
 	"fmt"
 	"os"
@@ -39,36 +37,9 @@ func loadBytesFromDataOrPath(prefix stri
 	}
 }
 
-// prepareTrustRoot creates a fulcioTrustRoot from the input data.
-// (This also prevents external implementations of this interface, ensuring that prSigstoreSignedFulcio is the only one.)
-func (f *prSigstoreSignedFulcio) prepareTrustRoot() (*fulcioTrustRoot, error) {
-	caCertBytes, err := loadBytesFromDataOrPath("fulcioCA", f.CAData, f.CAPath)
-	if err != nil {
-		return nil, err
-	}
-	if caCertBytes == nil {
-		return nil, errors.New(`Internal inconsistency: Fulcio specified with neither "caPath" nor "caData"`)
-	}
-	certs := x509.NewCertPool()
-	if ok := certs.AppendCertsFromPEM(caCertBytes); !ok {
-		return nil, errors.New("error loading Fulcio CA certificates")
-	}
-	fulcio := fulcioTrustRoot{
-		caCertificates: certs,
-		oidcIssuer:     f.OIDCIssuer,
-		subjectEmail:   f.SubjectEmail,
-	}
-	if err := fulcio.validate(); err != nil {
-		return nil, err
-	}
-	return &fulcio, nil
-}
-
 // sigstoreSignedTrustRoot contains an already parsed version of the prSigstoreSigned policy
 type sigstoreSignedTrustRoot struct {
 	publicKey      crypto.PublicKey
-	fulcio         *fulcioTrustRoot
-	rekorPublicKey *ecdsa.PublicKey
 }
 
 func (pr *prSigstoreSigned) prepareTrustRoot() (*sigstoreSignedTrustRoot, error) {
@@ -86,31 +57,6 @@ func (pr *prSigstoreSigned) prepareTrust
 		res.publicKey = pk
 	}
 
-	if pr.Fulcio != nil {
-		f, err := pr.Fulcio.prepareTrustRoot()
-		if err != nil {
-			return nil, err
-		}
-		res.fulcio = f
-	}
-
-	rekorPublicKeyPEM, err := loadBytesFromDataOrPath("rekorPublicKey", pr.RekorPublicKeyData, pr.RekorPublicKeyPath)
-	if err != nil {
-		return nil, err
-	}
-	if rekorPublicKeyPEM != nil {
-		pk, err := cryptoutils.UnmarshalPEMToPublicKey(rekorPublicKeyPEM)
-		if err != nil {
-			return nil, fmt.Errorf("parsing Rekor public key: %w", err)
-		}
-		pkECDSA, ok := pk.(*ecdsa.PublicKey)
-		if !ok {
-			return nil, fmt.Errorf("Rekor public key is not using ECDSA")
-
-		}
-		res.rekorPublicKey = pkECDSA
-	}
-
 	return &res, nil
 }
 
@@ -136,55 +82,8 @@ func (pr *prSigstoreSigned) isSignatureA
 
 	var publicKey crypto.PublicKey
 	switch {
-	case trustRoot.publicKey != nil && trustRoot.fulcio != nil: // newPRSigstoreSigned rejects such combinations.
-		return sarRejected, errors.New("Internal inconsistency: Both a public key and Fulcio CA specified")
-	case trustRoot.publicKey == nil && trustRoot.fulcio == nil: // newPRSigstoreSigned rejects such combinations.
-		return sarRejected, errors.New("Internal inconsistency: Neither a public key nor a Fulcio CA specified")
-
 	case trustRoot.publicKey != nil:
-		if trustRoot.rekorPublicKey != nil {
-			untrustedSET, ok := untrustedAnnotations[signature.SigstoreSETAnnotationKey]
-			if !ok { // For user convenience; passing an empty []byte to VerifyRekorSet should work.
-				return sarRejected, fmt.Errorf("missing %s annotation", signature.SigstoreSETAnnotationKey)
-			}
-			// We could use publicKeyPEM directly, but let’s re-marshal to avoid inconsistencies.
-			// FIXME: We could just generate DER instead of the full PEM text
-			recreatedPublicKeyPEM, err := cryptoutils.MarshalPublicKeyToPEM(trustRoot.publicKey)
-			if err != nil {
-				// Coverage: The key was loaded from a PEM format, so it’s unclear how this could fail.
-				// (PEM is not essential, MarshalPublicKeyToPEM can only fail if marshaling to ASN1.DER fails.)
-				return sarRejected, fmt.Errorf("re-marshaling public key to PEM: %w", err)
-
-			}
-			// We don’t care about the Rekor timestamp, just about log presence.
-			if _, err := internal.VerifyRekorSET(trustRoot.rekorPublicKey, []byte(untrustedSET), recreatedPublicKeyPEM, untrustedBase64Signature, untrustedPayload); err != nil {
-				return sarRejected, err
-			}
-		}
 		publicKey = trustRoot.publicKey
-
-	case trustRoot.fulcio != nil:
-		if trustRoot.rekorPublicKey == nil { // newPRSigstoreSigned rejects such combinations.
-			return sarRejected, errors.New("Internal inconsistency: Fulcio CA specified without a Rekor public key")
-		}
-		untrustedSET, ok := untrustedAnnotations[signature.SigstoreSETAnnotationKey]
-		if !ok { // For user convenience; passing an empty []byte to VerifyRekorSet should correctly reject it anyway.
-			return sarRejected, fmt.Errorf("missing %s annotation", signature.SigstoreSETAnnotationKey)
-		}
-		untrustedCert, ok := untrustedAnnotations[signature.SigstoreCertificateAnnotationKey]
-		if !ok { // For user convenience; passing an empty []byte to VerifyRekorSet should correctly reject it anyway.
-			return sarRejected, fmt.Errorf("missing %s annotation", signature.SigstoreCertificateAnnotationKey)
-		}
-		var untrustedIntermediateChainBytes []byte
-		if untrustedIntermediateChain, ok := untrustedAnnotations[signature.SigstoreIntermediateCertificateChainAnnotationKey]; ok {
-			untrustedIntermediateChainBytes = []byte(untrustedIntermediateChain)
-		}
-		pk, err := verifyRekorFulcio(trustRoot.rekorPublicKey, trustRoot.fulcio,
-			[]byte(untrustedSET), []byte(untrustedCert), untrustedIntermediateChainBytes, untrustedBase64Signature, untrustedPayload)
-		if err != nil {
-			return sarRejected, err
-		}
-		publicKey = pk
 	}
 
 	if publicKey == nil {
Index: golang-github-containers-image/signature/policy_types.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_types.go
+++ golang-github-containers-image/signature/policy_types.go
@@ -118,8 +118,6 @@ type prSigstoreSigned struct {
 	// FIXME: Multiple public keys?
 
 	// Fulcio specifies which Fulcio-generated certificates are accepted. Exactly one of KeyPath, KeyData, Fulcio must be specified.
-	// If Fulcio is specified, one of RekorPublicKeyPath or RekorPublicKeyData must be specified as well.
-	Fulcio PRSigstoreSignedFulcio `json:"fulcio,omitempty"`
 
 	// RekorPublicKeyPath is a pathname to local file containing a public key of a Rekor server which must record acceptable signatures.
 	// If Fulcio is used, one of RekorPublicKeyPath or RekorPublicKeyData must be specified as well; otherwise it is optional
@@ -136,14 +134,6 @@ type prSigstoreSigned struct {
 	SignedIdentity PolicyReferenceMatch `json:"signedIdentity"`
 }
 
-// PRSigstoreSignedFulcio contains Fulcio configuration options for a "sigstoreSigned" PolicyRequirement.
-// This is a public type with a single private implementation.
-type PRSigstoreSignedFulcio interface {
-	// toFulcioTrustRoot creates a fulcioTrustRoot from the input data.
-	// (This also prevents external implementations of this interface, ensuring that prSigstoreSignedFulcio is the only one.)
-	prepareTrustRoot() (*fulcioTrustRoot, error)
-}
-
 // prSigstoreSignedFulcio collects Fulcio configuration options for prSigstoreSigned
 type prSigstoreSignedFulcio struct {
 	// CAPath a path to a file containing accepted CA root certificates, in PEM format. Exactly one of CAPath and CAData must be specified.
Index: golang-github-containers-image/signature/policy_config_sigstore.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_config_sigstore.go
+++ golang-github-containers-image/signature/policy_config_sigstore.go
@@ -33,16 +33,6 @@ func PRSigstoreSignedWithKeyData(keyData
 	}
 }
 
-// PRSigstoreSignedWithFulcio specifies a value for the "fulcio" field when calling NewPRSigstoreSigned.
-func PRSigstoreSignedWithFulcio(fulcio PRSigstoreSignedFulcio) PRSigstoreSignedOption {
-	return func(pr *prSigstoreSigned) error {
-		if pr.Fulcio != nil {
-			return errors.New(`"fulcio" already specified`)
-		}
-		pr.Fulcio = fulcio
-		return nil
-	}
-}
 
 // PRSigstoreSignedWithRekorPublicKeyPath specifies a value for the "rekorPublicKeyPath" field when calling NewPRSigstoreSigned.
 func PRSigstoreSignedWithRekorPublicKeyPath(rekorPublicKeyPath string) PRSigstoreSignedOption {
@@ -95,9 +85,6 @@ func newPRSigstoreSigned(options ...PRSi
 	if res.KeyData != nil {
 		keySources++
 	}
-	if res.Fulcio != nil {
-		keySources++
-	}
 	if keySources != 1 {
 		return nil, InvalidPolicyFormatError("exactly one of keyPath, keyData and fulcio must be specified")
 	}
@@ -105,9 +92,6 @@ func newPRSigstoreSigned(options ...PRSi
 	if res.RekorPublicKeyPath != "" && res.RekorPublicKeyData != nil {
 		return nil, InvalidPolicyFormatError("rekorPublickeyType and rekorPublickeyData cannot be used simultaneously")
 	}
-	if res.Fulcio != nil && res.RekorPublicKeyPath == "" && res.RekorPublicKeyData == nil {
-		return nil, InvalidPolicyFormatError("At least one of RekorPublickeyPath and RekorPublickeyData must be specified if fulcio is used")
-	}
 
 	if res.SignedIdentity == nil {
 		return nil, InvalidPolicyFormatError("signedIdentity not specified")
@@ -144,8 +128,7 @@ var _ json.Unmarshaler = (*prSigstoreSig
 func (pr *prSigstoreSigned) UnmarshalJSON(data []byte) error {
 	*pr = prSigstoreSigned{}
 	var tmp prSigstoreSigned
-	var gotKeyPath, gotKeyData, gotFulcio, gotRekorPublicKeyPath, gotRekorPublicKeyData bool
-	var fulcio prSigstoreSignedFulcio
+	var gotKeyPath, gotKeyData, gotRekorPublicKeyPath, gotRekorPublicKeyData bool
 	var signedIdentity json.RawMessage
 	if err := internal.ParanoidUnmarshalJSONObject(data, func(key string) any {
 		switch key {
@@ -157,9 +140,6 @@ func (pr *prSigstoreSigned) UnmarshalJSO
 		case "keyData":
 			gotKeyData = true
 			return &tmp.KeyData
-		case "fulcio":
-			gotFulcio = true
-			return &fulcio
 		case "rekorPublicKeyPath":
 			gotRekorPublicKeyPath = true
 			return &tmp.RekorPublicKeyPath
@@ -195,9 +175,6 @@ func (pr *prSigstoreSigned) UnmarshalJSO
 	if gotKeyData {
 		opts = append(opts, PRSigstoreSignedWithKeyData(tmp.KeyData))
 	}
-	if gotFulcio {
-		opts = append(opts, PRSigstoreSignedWithFulcio(&fulcio))
-	}
 	if gotRekorPublicKeyPath {
 		opts = append(opts, PRSigstoreSignedWithRekorPublicKeyPath(tmp.RekorPublicKeyPath))
 	}
@@ -213,131 +190,3 @@ func (pr *prSigstoreSigned) UnmarshalJSO
 	*pr = *res
 	return nil
 }
-
-// PRSigstoreSignedFulcioOption is a way to pass values to NewPRSigstoreSignedFulcio
-type PRSigstoreSignedFulcioOption func(*prSigstoreSignedFulcio) error
-
-// PRSigstoreSignedFulcioWithCAPath specifies a value for the "caPath" field when calling NewPRSigstoreSignedFulcio
-func PRSigstoreSignedFulcioWithCAPath(caPath string) PRSigstoreSignedFulcioOption {
-	return func(f *prSigstoreSignedFulcio) error {
-		if f.CAPath != "" {
-			return errors.New(`"caPath" already specified`)
-		}
-		f.CAPath = caPath
-		return nil
-	}
-}
-
-// PRSigstoreSignedFulcioWithCAData specifies a value for the "caData" field when calling NewPRSigstoreSignedFulcio
-func PRSigstoreSignedFulcioWithCAData(caData []byte) PRSigstoreSignedFulcioOption {
-	return func(f *prSigstoreSignedFulcio) error {
-		if f.CAData != nil {
-			return errors.New(`"caData" already specified`)
-		}
-		f.CAData = caData
-		return nil
-	}
-}
-
-// PRSigstoreSignedFulcioWithOIDCIssuer specifies a value for the "oidcIssuer" field when calling NewPRSigstoreSignedFulcio
-func PRSigstoreSignedFulcioWithOIDCIssuer(oidcIssuer string) PRSigstoreSignedFulcioOption {
-	return func(f *prSigstoreSignedFulcio) error {
-		if f.OIDCIssuer != "" {
-			return errors.New(`"oidcIssuer" already specified`)
-		}
-		f.OIDCIssuer = oidcIssuer
-		return nil
-	}
-}
-
-// PRSigstoreSignedFulcioWithSubjectEmail specifies a value for the "subjectEmail" field when calling NewPRSigstoreSignedFulcio
-func PRSigstoreSignedFulcioWithSubjectEmail(subjectEmail string) PRSigstoreSignedFulcioOption {
-	return func(f *prSigstoreSignedFulcio) error {
-		if f.SubjectEmail != "" {
-			return errors.New(`"subjectEmail" already specified`)
-		}
-		f.SubjectEmail = subjectEmail
-		return nil
-	}
-}
-
-// newPRSigstoreSignedFulcio is NewPRSigstoreSignedFulcio, except it returns the private type
-func newPRSigstoreSignedFulcio(options ...PRSigstoreSignedFulcioOption) (*prSigstoreSignedFulcio, error) {
-	res := prSigstoreSignedFulcio{}
-	for _, o := range options {
-		if err := o(&res); err != nil {
-			return nil, err
-		}
-	}
-
-	if res.CAPath != "" && res.CAData != nil {
-		return nil, InvalidPolicyFormatError("caPath and caData cannot be used simultaneously")
-	}
-	if res.CAPath == "" && res.CAData == nil {
-		return nil, InvalidPolicyFormatError("At least one of caPath and caData must be specified")
-	}
-	if res.OIDCIssuer == "" {
-		return nil, InvalidPolicyFormatError("oidcIssuer not specified")
-	}
-	if res.SubjectEmail == "" {
-		return nil, InvalidPolicyFormatError("subjectEmail not specified")
-	}
-
-	return &res, nil
-}
-
-// NewPRSigstoreSignedFulcio returns a PRSigstoreSignedFulcio based on options.
-func NewPRSigstoreSignedFulcio(options ...PRSigstoreSignedFulcioOption) (PRSigstoreSignedFulcio, error) {
-	return newPRSigstoreSignedFulcio(options...)
-}
-
-// Compile-time check that prSigstoreSignedFulcio implements json.Unmarshaler.
-var _ json.Unmarshaler = (*prSigstoreSignedFulcio)(nil)
-
-func (f *prSigstoreSignedFulcio) UnmarshalJSON(data []byte) error {
-	*f = prSigstoreSignedFulcio{}
-	var tmp prSigstoreSignedFulcio
-	var gotCAPath, gotCAData, gotOIDCIssuer, gotSubjectEmail bool // = false...
-	if err := internal.ParanoidUnmarshalJSONObject(data, func(key string) any {
-		switch key {
-		case "caPath":
-			gotCAPath = true
-			return &tmp.CAPath
-		case "caData":
-			gotCAData = true
-			return &tmp.CAData
-		case "oidcIssuer":
-			gotOIDCIssuer = true
-			return &tmp.OIDCIssuer
-		case "subjectEmail":
-			gotSubjectEmail = true
-			return &tmp.SubjectEmail
-		default:
-			return nil
-		}
-	}); err != nil {
-		return err
-	}
-
-	var opts []PRSigstoreSignedFulcioOption
-	if gotCAPath {
-		opts = append(opts, PRSigstoreSignedFulcioWithCAPath(tmp.CAPath))
-	}
-	if gotCAData {
-		opts = append(opts, PRSigstoreSignedFulcioWithCAData(tmp.CAData))
-	}
-	if gotOIDCIssuer {
-		opts = append(opts, PRSigstoreSignedFulcioWithOIDCIssuer(tmp.OIDCIssuer))
-	}
-	if gotSubjectEmail {
-		opts = append(opts, PRSigstoreSignedFulcioWithSubjectEmail(tmp.SubjectEmail))
-	}
-
-	res, err := newPRSigstoreSignedFulcio(opts...)
-	if err != nil {
-		return err
-	}
-
-	*f = *res
-	return nil
-}
Index: golang-github-containers-image/signature/fulcio_cert_test.go
===================================================================
--- golang-github-containers-image.orig/signature/fulcio_cert_test.go
+++ golang-github-containers-image/signature/fulcio_cert_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/signature/internal/rekor_set_test.go
===================================================================
--- golang-github-containers-image.orig/signature/internal/rekor_set_test.go
+++ golang-github-containers-image/signature/internal/rekor_set_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_rekor
+// +build debian_no_rekor
 package internal
 
 import (
Index: golang-github-containers-image/signature/policy_config_sigstore_test.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_config_sigstore_test.go
+++ golang-github-containers-image/signature/policy_config_sigstore_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/signature/policy_config_test.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_config_test.go
+++ golang-github-containers-image/signature/policy_config_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/signature/policy_eval_sigstore_test.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_eval_sigstore_test.go
+++ golang-github-containers-image/signature/policy_eval_sigstore_test.go
@@ -1,3 +1,6 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
+
 // Policy evaluation for prCosignSigned.
 
 package signature
Index: golang-github-containers-image/signature/policy_eval_test.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_eval_test.go
+++ golang-github-containers-image/signature/policy_eval_test.go
@@ -1,3 +1,6 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
+
 package signature
 
 import (
Index: golang-github-containers-image/signature/simple_test.go
===================================================================
--- golang-github-containers-image.orig/signature/simple_test.go
+++ golang-github-containers-image/signature/simple_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/signature/policy_eval_signedby_test.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_eval_signedby_test.go
+++ golang-github-containers-image/signature/policy_eval_signedby_test.go
@@ -1,3 +1,6 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
+
 package signature
 
 import (
Index: golang-github-containers-image/signature/policy_eval_baselayer_test.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_eval_baselayer_test.go
+++ golang-github-containers-image/signature/policy_eval_baselayer_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/signature/policy_eval_simple_test.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_eval_simple_test.go
+++ golang-github-containers-image/signature/policy_eval_simple_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/copy/sign.go
===================================================================
--- golang-github-containers-image.orig/copy/sign.go
+++ golang-github-containers-image/copy/sign.go
@@ -8,7 +8,6 @@ import (
 	"github.com/containers/image/v5/internal/private"
 	internalsig "github.com/containers/image/v5/internal/signature"
 	internalSigner "github.com/containers/image/v5/internal/signer"
-	"github.com/containers/image/v5/signature/sigstore"
 	"github.com/containers/image/v5/signature/simplesigning"
 	"github.com/containers/image/v5/transports"
 )
@@ -32,17 +31,6 @@ func (c *copier) setupSigners() error {
 		if err != nil {
 			return err
 		}
-		c.signers = append(c.signers, signer)
-		c.signersToClose = append(c.signersToClose, signer)
-	}
-
-	if c.options.SignBySigstorePrivateKeyFile != "" {
-		signer, err := sigstore.NewSigner(
-			sigstore.WithPrivateKeyFile(c.options.SignBySigstorePrivateKeyFile, c.options.SignSigstorePrivateKeyPassphrase),
-		)
-		if err != nil {
-			return err
-		}
 		c.signers = append(c.signers, signer)
 		c.signersToClose = append(c.signersToClose, signer)
 	}
Index: golang-github-containers-image/internal/signature/signature.go
===================================================================
--- golang-github-containers-image.orig/internal/signature/signature.go
+++ golang-github-containers-image/internal/signature/signature.go
@@ -78,8 +78,6 @@ func FromBlob(blob []byte) (Signature, e
 		switch {
 		case bytes.Equal(formatBytes, []byte(SimpleSigningFormat)):
 			return SimpleSigningFromBlob(blobChunk), nil
-		case bytes.Equal(formatBytes, []byte(SigstoreFormat)):
-			return sigstoreFromBlobChunk(blobChunk)
 		default:
 			return nil, fmt.Errorf("unrecognized signature format %q", string(formatBytes))
 		}
Index: golang-github-containers-image/docker/docker_image_dest.go
===================================================================
--- golang-github-containers-image.orig/docker/docker_image_dest.go
+++ golang-github-containers-image/docker/docker_image_dest.go
@@ -18,7 +18,6 @@ import (
 	"github.com/containers/image/v5/internal/blobinfocache"
 	"github.com/containers/image/v5/internal/imagedestination/impl"
 	"github.com/containers/image/v5/internal/imagedestination/stubs"
-	"github.com/containers/image/v5/internal/iolimits"
 	"github.com/containers/image/v5/internal/private"
 	"github.com/containers/image/v5/internal/putblobdigest"
 	"github.com/containers/image/v5/internal/set"
@@ -26,14 +25,12 @@ import (
 	"github.com/containers/image/v5/internal/streamdigest"
 	"github.com/containers/image/v5/internal/uploadreader"
 	"github.com/containers/image/v5/manifest"
-	"github.com/containers/image/v5/pkg/blobinfocache/none"
 	"github.com/containers/image/v5/types"
 	"github.com/docker/distribution/registry/api/errcode"
 	v2 "github.com/docker/distribution/registry/api/v2"
 	"github.com/opencontainers/go-digest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
 	"golang.org/x/exp/slices"
 )
 
@@ -551,24 +548,9 @@ func (d *dockerImageDestination) PutSign
 		instanceDigest = &d.manifestDigest
 	}
 
-	sigstoreSignatures := []signature.Sigstore{}
 	otherSignatures := []signature.Signature{}
 	for _, sig := range signatures {
-		if sigstoreSig, ok := sig.(signature.Sigstore); ok {
-			sigstoreSignatures = append(sigstoreSignatures, sigstoreSig)
-		} else {
-			otherSignatures = append(otherSignatures, sig)
-		}
-	}
-
-	// Only write sigstores signatures to sigstores attachments. We _could_ store them to lookaside
-	// instead, but that would probably be rather surprising.
-	// FIXME: So should we enable sigstores in all cases? Or write in all cases, but opt-in to read?
-
-	if len(sigstoreSignatures) != 0 {
-		if err := d.putSignaturesToSigstoreAttachments(ctx, sigstoreSignatures, *instanceDigest); err != nil {
-			return err
-		}
+		otherSignatures = append(otherSignatures, sig)
 	}
 
 	if len(otherSignatures) != 0 {
@@ -657,112 +639,6 @@ func (d *dockerImageDestination) putOneS
 	}
 }
 
-func (d *dockerImageDestination) putSignaturesToSigstoreAttachments(ctx context.Context, signatures []signature.Sigstore, manifestDigest digest.Digest) error {
-	if !d.c.useSigstoreAttachments {
-		return errors.New("writing sigstore attachments is disabled by configuration")
-	}
-
-	ociManifest, err := d.c.getSigstoreAttachmentManifest(ctx, d.ref, manifestDigest)
-	if err != nil {
-		return err
-	}
-	var ociConfig imgspecv1.Image // Most fields empty by default
-	if ociManifest == nil {
-		ociManifest = manifest.OCI1FromComponents(imgspecv1.Descriptor{
-			MediaType: imgspecv1.MediaTypeImageConfig,
-			Digest:    "", // We will fill this in later.
-			Size:      0,
-		}, nil)
-		ociConfig.RootFS.Type = "layers"
-	} else {
-		logrus.Debugf("Fetching sigstore attachment config %s", ociManifest.Config.Digest.String())
-		// We don’t benefit from a real BlobInfoCache here because we never try to reuse/mount configs.
-		configBlob, err := d.c.getOCIDescriptorContents(ctx, d.ref, ociManifest.Config, iolimits.MaxConfigBodySize,
-			none.NoCache)
-		if err != nil {
-			return err
-		}
-		if err := json.Unmarshal(configBlob, &ociConfig); err != nil {
-			return fmt.Errorf("parsing sigstore attachment config %s in %s: %w", ociManifest.Config.Digest.String(),
-				d.ref.ref.Name(), err)
-		}
-	}
-
-	for _, sig := range signatures {
-		mimeType := sig.UntrustedMIMEType()
-		payloadBlob := sig.UntrustedPayload()
-		annotations := sig.UntrustedAnnotations()
-
-		alreadyOnRegistry := false
-		for _, layer := range ociManifest.Layers {
-			if layerMatchesSigstoreSignature(layer, mimeType, payloadBlob, annotations) {
-				logrus.Debugf("Signature with digest %s already exists on the registry", layer.Digest.String())
-				alreadyOnRegistry = true
-				break
-			}
-		}
-		if alreadyOnRegistry {
-			continue
-		}
-
-		// We don’t benefit from a real BlobInfoCache here because we never try to reuse/mount attachment payloads.
-		// That might eventually need to change if payloads grow to be not just signatures, but something
-		// significantly large.
-		sigDesc, err := d.putBlobBytesAsOCI(ctx, payloadBlob, mimeType, private.PutBlobOptions{
-			Cache:      none.NoCache,
-			IsConfig:   false,
-			EmptyLayer: false,
-			LayerIndex: nil,
-		})
-		if err != nil {
-			return err
-		}
-		sigDesc.Annotations = annotations
-		ociManifest.Layers = append(ociManifest.Layers, sigDesc)
-		ociConfig.RootFS.DiffIDs = append(ociConfig.RootFS.DiffIDs, sigDesc.Digest)
-		logrus.Debugf("Adding new signature, digest %s", sigDesc.Digest.String())
-	}
-
-	configBlob, err := json.Marshal(ociConfig)
-	if err != nil {
-		return err
-	}
-	logrus.Debugf("Uploading updated sigstore attachment config")
-	// We don’t benefit from a real BlobInfoCache here because we never try to reuse/mount configs.
-	configDesc, err := d.putBlobBytesAsOCI(ctx, configBlob, imgspecv1.MediaTypeImageConfig, private.PutBlobOptions{
-		Cache:      none.NoCache,
-		IsConfig:   true,
-		EmptyLayer: false,
-		LayerIndex: nil,
-	})
-	if err != nil {
-		return err
-	}
-	ociManifest.Config = configDesc
-
-	manifestBlob, err := ociManifest.Serialize()
-	if err != nil {
-		return err
-	}
-	logrus.Debugf("Uploading sigstore attachment manifest")
-	return d.uploadManifest(ctx, manifestBlob, sigstoreAttachmentTag(manifestDigest))
-}
-
-func layerMatchesSigstoreSignature(layer imgspecv1.Descriptor, mimeType string,
-	payloadBlob []byte, annotations map[string]string) bool {
-	if layer.MediaType != mimeType ||
-		layer.Size != int64(len(payloadBlob)) ||
-		// This is not quite correct, we should use the layer’s digest algorithm.
-		// But right now we don’t want to deal with corner cases like bad digest formats
-		// or unavailable algorithms; in the worst case we end up with duplicate signature
-		// entries.
-		layer.Digest.String() != digest.FromBytes(payloadBlob).String() ||
-		!maps.Equal(layer.Annotations, annotations) {
-		return false
-	}
-	return true
-}
-
 // putBlobBytesAsOCI uploads a blob with the specified contents, and returns an appropriate
 // OCI descriptor.
 func (d *dockerImageDestination) putBlobBytesAsOCI(ctx context.Context, contents []byte, mimeType string, options private.PutBlobOptions) (imgspecv1.Descriptor, error) {
Index: golang-github-containers-image/signature/policy_config.go
===================================================================
--- golang-github-containers-image.orig/signature/policy_config.go
+++ golang-github-containers-image/signature/policy_config.go
@@ -243,8 +243,6 @@ func newPolicyRequirementFromJSON(data [
 		res = &prSignedBy{}
 	case prTypeSignedBaseLayer:
 		res = &prSignedBaseLayer{}
-	case prTypeSigstoreSigned:
-		res = &prSigstoreSigned{}
 	default:
 		return nil, InvalidPolicyFormatError(fmt.Sprintf("Unknown policy requirement type \"%s\"", typeField.Type))
 	}
Index: golang-github-containers-image/docker/docker_image_src.go
===================================================================
--- golang-github-containers-image.orig/docker/docker_image_src.go
+++ golang-github-containers-image/docker/docker_image_src.go
@@ -20,7 +20,6 @@ import (
 	"github.com/containers/image/v5/internal/private"
 	"github.com/containers/image/v5/internal/signature"
 	"github.com/containers/image/v5/manifest"
-	"github.com/containers/image/v5/pkg/blobinfocache/none"
 	"github.com/containers/image/v5/pkg/sysregistriesv2"
 	"github.com/containers/image/v5/types"
 	"github.com/containers/storage/pkg/regexp"
@@ -552,41 +551,8 @@ func (s *dockerImageSource) getSignature
 }
 
 func (s *dockerImageSource) getSignaturesFromSigstoreAttachments(ctx context.Context, instanceDigest *digest.Digest) ([]signature.Signature, error) {
-	if !s.c.useSigstoreAttachments {
-		logrus.Debugf("Not looking for sigstore attachments: disabled by configuration")
-		return nil, nil
-	}
-
-	manifestDigest, err := s.manifestDigest(ctx, instanceDigest)
-	if err != nil {
-		return nil, err
-	}
-
-	ociManifest, err := s.c.getSigstoreAttachmentManifest(ctx, s.physicalRef, manifestDigest)
-	if err != nil {
-		return nil, err
-	}
-	if ociManifest == nil {
-		return nil, nil
-	}
-
-	logrus.Debugf("Found a sigstore attachment manifest with %d layers", len(ociManifest.Layers))
-	res := []signature.Signature{}
-	for layerIndex, layer := range ociManifest.Layers {
-		// Note that this copies all kinds of attachments: attestations, and whatever else is there,
-		// not just signatures. We leave the signature consumers to decide based on the MIME type.
-		logrus.Debugf("Fetching sigstore attachment %d/%d: %s", layerIndex+1, len(ociManifest.Layers), layer.Digest.String())
-		// We don’t benefit from a real BlobInfoCache here because we never try to reuse/mount attachment payloads.
-		// That might eventually need to change if payloads grow to be not just signatures, but something
-		// significantly large.
-		payload, err := s.c.getOCIDescriptorContents(ctx, s.physicalRef, layer, iolimits.MaxSignatureBodySize,
-			none.NoCache)
-		if err != nil {
-			return nil, err
-		}
-		res = append(res, signature.SigstoreFromComponents(layer.MediaType, payload, layer.Annotations))
-	}
-	return res, nil
+	logrus.Debugf("Not looking for sigstore attachments: disabled by configuration")
+	return nil, nil
 }
 
 // deleteImage deletes the named image from the registry, if supported.
Index: golang-github-containers-image/internal/signature/signature_test.go
===================================================================
--- golang-github-containers-image.orig/internal/signature/signature_test.go
+++ golang-github-containers-image/internal/signature/signature_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package signature
 
 import (
Index: golang-github-containers-image/signature/internal/sigstore_payload_test.go
===================================================================
--- golang-github-containers-image.orig/signature/internal/sigstore_payload_test.go
+++ golang-github-containers-image/signature/internal/sigstore_payload_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package internal
 
 import (
Index: golang-github-containers-image/internal/signer/signer_test.go
===================================================================
--- golang-github-containers-image.orig/internal/signer/signer_test.go
+++ golang-github-containers-image/internal/signer/signer_test.go
@@ -1,3 +1,6 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
+
 package signer
 
 import (
Index: golang-github-containers-image/copy/sign_test.go
===================================================================
--- golang-github-containers-image.orig/copy/sign_test.go
+++ golang-github-containers-image/copy/sign_test.go
@@ -1,3 +1,5 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
 package copy
 
 import (
Index: golang-github-containers-image/signature/sigstore/fulcio/fulcio.go
===================================================================
--- golang-github-containers-image.orig/signature/sigstore/fulcio/fulcio.go
+++ golang-github-containers-image/signature/sigstore/fulcio/fulcio.go
@@ -1,3 +1,6 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
+
 package fulcio
 
 import (
Index: golang-github-containers-image/signature/sigstore/fulcio/no_fulcio.go
===================================================================
--- /dev/null
+++ golang-github-containers-image/signature/sigstore/fulcio/no_fulcio.go
@@ -0,0 +1,33 @@
+//go:build !debian_no_fulcio
+// +build !debian_no_fulcio
+
+package fulcio
+
+import (
+	"io"
+	"fmt"
+	"net/url"
+
+	"github.com/containers/image/v5/signature/sigstore/internal"
+)
+
+
+func WithFulcioAndDeviceAuthorizationGrantOIDC(fulcioURL *url.URL, oidcIssuerURL *url.URL, oidcClientID, oidcClientSecret string,
+	interactiveOutput io.Writer) internal.Option {
+	return func(s *internal.SigstoreSigner) error {
+		return fmt.Errorf("Debian-local: fulcio disabled")
+	}
+}
+
+func WithFulcioAndPreexistingOIDCIDToken(fulcioURL *url.URL, oidcIDToken string) internal.Option {
+	return func(s *internal.SigstoreSigner) error {
+		return fmt.Errorf("Debian-local: fulcio disabled")
+	}
+}
+
+func WithFulcioAndInteractiveOIDC(fulcioURL *url.URL, oidcIssuerURL *url.URL, oidcClientID, oidcClientSecret string,
+	interactiveInput io.Reader, interactiveOutput io.Writer) internal.Option {
+	return func(s *internal.SigstoreSigner) error {
+		return fmt.Errorf("Debian-local: fulcio disabled")
+	}
+}
Index: golang-github-containers-image/signature/sigstore/rekor/no_rekor.go
===================================================================
--- /dev/null
+++ golang-github-containers-image/signature/sigstore/rekor/no_rekor.go
@@ -0,0 +1,17 @@
+//go:build !debian_no_fulcio
+// +build !debian_no_fulcio
+
+package rekor
+
+import (
+	"fmt"
+	"net/url"
+
+	signerInternal "github.com/containers/image/v5/signature/sigstore/internal"
+)
+
+func WithRekor(rekorURL *url.URL) signerInternal.Option {
+	return func(s *signerInternal.SigstoreSigner) error {
+		return fmt.Errorf("Debian-local: fulcio disabled")
+	}
+}
Index: golang-github-containers-image/signature/sigstore/rekor/rekor.go
===================================================================
--- golang-github-containers-image.orig/signature/sigstore/rekor/rekor.go
+++ golang-github-containers-image/signature/sigstore/rekor/rekor.go
@@ -1,3 +1,6 @@
+//go:build debian_no_fulcio
+// +build debian_no_fulcio
+
 package rekor
 
 import (