syft attest --output cyclonedx-json incompatible with cosign

[lehors]

What happened:
Produced an attestation with syft but cosign verify-attestation couldn't find it.

What you expected to happen:

cosign verify-attestation should successfully verify the attestation produced by syft

How to reproduce it (as minimally and precisely as possible):

$ syft attest --output cyclonedx-json localhost:5000/hello:latest

$ COSIGN_EXPERIMENTAL=1 cosign verify-attestation --allow-insecure-registry --type cyclonedx localhost:5000/hello:latest
Error: none of the attestations matched the predicate type: cyclonedx
main.go:62: error during command execution: none of the attestations matched the predicate type: cyclonedx

Anything else we need to know?:

The problem comes from syft using "https://cyclonedx.org/bom" as the predicate while cosign uses "https://cyclonedx.org/schema" defined in-toto-golang

Environment:

• Output of syft version:
  Application: syft
  Version: 0.58.0
  JsonSchemaVersion: 4.0.0
  BuildDate: 2022-09-29T19:59:22Z
  GitCommit: b9b13d5
  GitDescription: v0.58.0
  Platform: darwin/amd64
  GoVersion: go1.18.6
  Compiler: gc
• OS (e.g: cat /etc/os-release or similar):
  MacOs

[lehors]

See related comment: in-toto/attestation#82 (comment)

[lehors]

It turns out that syft is using the predicate the CycloneDX project has selected (see CycloneDX/specification#132) so the issue ends up being more on the cosign side. I submitted a PR to update in-toto after which the incompatibility will disappear.

It would still be good for syft to pull the definition from the in-toto project directly rather than have its own definition so I suggest keeping this open until that change is made with PR #1270

[lehors]

Fixed with PR #1270

[spiffcs]

Thank you @lehors for all the help on this one!