Unable to sign image with kaniko when using --no-push arg

Expected Behavior

The image is signed.

Actual Behavior

The image is not signed.

Steps to Reproduce the Problem

I have the following tasks in a pipeline:

# Build OCI Image
 - name: kaniko-build
   runAfter: ["makefile-lint", "markdown-lint", "gitleaks", "pylint", "pytest", "docker-lint", "opa-dockerfile-validation", "helm-k8s-lint", "opa-helm-validation"]
   taskRef:
     name: kaniko
     kind: Task
   params:
     - name: IMAGE
       value: $(params.image-reference-prod)
     - name: EXTRA_ARGS
       value:
         - --skip-tls-verify
         - --insecure
         - --no-push
         - --tarPath=image.tar
   workspaces:
     - name: source
       workspace: shared-data
 # Image scan with trivy
 - name: trivy-scan-local-image
   runAfter: ["kaniko-build"]
   taskRef:
     name: trivy-scanner
     kind: Task
   params:
     - name: ARGS
       value: ["$(params.trivy_args_image_local[*])"]
     - name: IMAGE_PATH
       value: "/workspace/manifest-dir/image.tar"
   workspaces:
     - name: manifest-dir
       workspace: shared-data
 # Copy scanned image to production registry
 - name: skopeo-copy-to-production
   runAfter: ["trivy-scan-local-image"]
   taskRef:
     name: skopeo-copy
     kind: Task
   params:
     - name: srcImageURL
       value: "docker-archive:workspace/images-url/image.tar"
     - name: destImageURL
       value: "docker://$(params.image-reference-prod)"
     - name: srcTLSverify
       value: "false"
   workspaces:
     - name: images-url
       workspace: shared-data

So basically:

• build image with kaniko (local build with the --no-push and the --tarPath args)
• scan image with trivy
• copy image to remote docker registry

The pipeline work as intended but I am not able to sign the builded image (kaniko tasks) via Tekton chains.
How can I sign the local .tar artifact produced by Kaniko (via tekton chains)?

Additional Info

• Kubernetes version:

  Output of kubectl version:

WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short.  Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.1", GitCommit:"4c9411232e10168d7b050c49a1b59f6df9d7ea4b", GitTreeState:"clean", BuildDate:"2023-04-14T13:21:19Z", GoVersion:"go1.20.3", Compiler:"gc", Platform:"darwin/amd64"}
Kustomize Version: v5.0.1
Server Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.3", GitCommit:"9e644106593f3f4aa98f8a84b23db5fa378900bd", GitTreeState:"clean", BuildDate:"2023-03-15T13:33:12Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}

• Tekton Pipeline version:

  Output of tkn version:

Client version: 0.30.1
Chains version: v0.16.0
Pipeline version: v0.47.0
Dashboard version: v0.35.0

TaskRun describe:

kubectl describe tr clone-build-push-run-fnnbf-kaniko-build

[ . . . ]

Events:
  Type     Reason           Age                    From                Message
  ----     ------           ----                   ----                -------
  Normal   FinalizerUpdate  10m                    taskrun-controller  Updated "clone-build-push-run-fnnbf-kaniko-build" finalizers
  Normal   Started          10m (x2 over 10m)      TaskRun             
  Normal   Pending          10m                    TaskRun             Pending
  Normal   Pending          10m                    TaskRun             pod status "Initialized":"False"; message: "containers with incomplete status: [prepare place-scripts working-dir-initializer]"
  Normal   Pending          10m                    TaskRun             pod status "Initialized":"False"; message: "containers with incomplete status: [place-scripts working-dir-initializer]"
  Normal   Pending          10m                    TaskRun             pod status "Initialized":"False"; message: "containers with incomplete status: [working-dir-initializer]"
  Normal   Pending          10m                    TaskRun             pod status "Ready":"False"; message: "containers with unready status: [step-build-and-push step-write-url]"
  Normal   Running          10m                    TaskRun             Not all Steps in the Task have finished executing
  Normal   Succeeded        9m46s                  TaskRun             All Steps have completed executing
  Warning  InternalError    9m40s (x5 over 9m44s)  taskrun-controller  1 error occurred:
           * getting signed image: entity not found in registry

Start with the reported TaskRun and the InternalError stating “getting signed image: entity not found in registry.” Trace how Tekton Chains handles the kaniko --no-push and --tarPath outputs, alongside the later skopeo copy step. Done should establish whether local tar artifacts can be signed or clearly identify the supported workflow.