Follow-up to #227.
#227 attaches provenance (mode=max) and SBOM attestations via buildkit and signs the image manifest digest with cosign sign. The buildkit-attached attestations themselves are not cosign-signed, so policy engines that verify attestation signatures before trusting the predicate (e.g. Kyverno extractPayload) cannot use them.
Per @acidghost in #227 (review): extract the SBOM per platform and run cosign attest --type spdxjson --predicate <file> "${IMAGE}@${DIGEST}" (and similarly for provenance) so the predicate carries a verifiable signature.
Reference implementations:
Follow-up to #227.
#227 attaches provenance (
mode=max) and SBOM attestations via buildkit and signs the image manifest digest withcosign sign. The buildkit-attached attestations themselves are not cosign-signed, so policy engines that verify attestation signatures before trusting the predicate (e.g. KyvernoextractPayload) cannot use them.Per @acidghost in #227 (review): extract the SBOM per platform and run
cosign attest --type spdxjson --predicate <file> "${IMAGE}@${DIGEST}"(and similarly for provenance) so the predicate carries a verifiable signature.Reference implementations: