🐑 syft sbom 🐑

petbattle · May 31, 2023 · 51570d8 · 51570d8
1 parent a4f6f2a
commit 51570d8
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/.github/workflows/build_container.yaml b/.github/workflows/build_container.yaml
@@ -88,6 +88,7 @@ jobs:
       # Provenance SBOM and attestation
       - name: Generate SBOM
         uses: anchore/sbom-action@v0
+        id: syft
         with:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAGS }}
           registry-username: ${{ secrets.QUAY_USER }}
@@ -96,7 +97,7 @@ jobs:
 
       - name: Attach SBOM to image
         run: |
-          cosign attach sbom --sbom pet-battle-api.sbom \
+          cosign attach sbom --sbom ${{ steps.syft.output-file }} \
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAGS }}
         env:
           COSIGN_PASSWORD: ""

diff --git a/README.md b/README.md
@@ -281,3 +281,17 @@ To verify an image:
 curl --progress-bar -o cosign.pub https://raw.githubusercontent.com/petbattle/pet-battle-api/master/cosign.pub
 cosign verify --key cosign.pub quay.io/petbattle/pet-battle-api:latest
 ```
+
+SBOM generated using [syft](https://github.com/anchore/syft). 
+
+Verify signed SBOM:
+
+```bash
+cosign verify --key cosign.pub --attachment sbom quay.io/petbattle/pet-battle-api:latest
+```
+
+Verify SBOM attestation:
+
+```bash
+cosign verify-attestation --key cosign.pub quay.io/petbattle/pet-battle-api:latest
+```