docs(sbom): improve SBOM docs by adding a description for scanning SBOM attestation #2690
Conversation
| In the following example, Cosign can get an attestation and trivy scan it. | ||
|
|
||
| ```bash | ||
| $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl |
There was a problem hiding this comment.
If it includes several attestations, Trivy fails to scan, right?
There was a problem hiding this comment.
The --type cyclonedx option of Cosign will take only cyclonedx attestation if the image has multiple attestations.
Depending on the number of cyclonedx attestations, the behavior will be as follows.
- If there is no cycnlonedx attestation, the cosign command will fail.
- If there is one cycnlonedx attestation, Trivy will successfully scan. This situation is assumed in the text of the description.
- (rare case) If there is more than one cycnlonedx attestation, it will also successfully scan because json.NewReader parses only the first line if there are multiple lines in input data(ref). This is unintended behavior but it is not bad because they may be the same content.
There was a problem hiding this comment.
I've added a note that before trying the example, you create CycloneDX-type attestation.
There was a problem hiding this comment.
If there is more than one cycnlonedx attestation, it will also successfully scan because json.NewReader parses only the first line if there are multiple lines in input data(ref).
I didn't know that. Cool. Thanks for your explanation.
|
Since CycloneDX is more advanced supported than SPDX, I've used CycloneDX in the example. |
Description
I've improved SBOM docs by adding a description for scanning SBOM attestation.
Related issues
Checklist