🌱 Attach and sign SBOM to images

[mudler]

Is your feature request related to a problem? Please describe.
Now that we have a SBOM file, we can attach and sign that with cosign so it is signed along the process, and easily verifiable with the cosign CLI

Describe the solution you'd like
The CI to sign and attach sbom file automatically when signing images.
When we do this, also create a blog post for this explaining how users can see the SBOM of the images, validate the image and the SBOM. Also show how to use grype to generate a security report from it.

Describe alternatives you've considered

Additional context
https://docs.sigstore.dev/cosign/other_types/

[Itxaka]

Before signing: cosign attach sbom --sbom SBOM.spdx IMAGE:TAG should make it

[mudler]

that attaches it, we need also to sign it after it was attached:

e.g.

$ cosign sign --key cosign.key gcr.io/$(gcloud config get-value project)/alpine:sha256-e1c082e3d3c45cccac829840a25941e679c25d438cc8412c2fa221cf1a824e6a.sbom

[Itxaka]

that attaches it, we need also to sign it after it was attached:

e.g.

$ cosign sign --key cosign.key gcr.io/$(gcloud config get-value project)/alpine:sha256-e1c082e3d3c45cccac829840a25941e679c25d438cc8412c2fa221cf1a824e6a.sbom

yes, sorry, thats what I (tried to) mean, that we need to attach before signing :D

Bit slow this morning ☕

[mudler]

that attaches it, we need also to sign it after it was attached:
e.g.

$ cosign sign --key cosign.key gcr.io/$(gcloud config get-value project)/alpine:sha256-e1c082e3d3c45cccac829840a25941e679c25d438cc8412c2fa221cf1a824e6a.sbom

yes, sorry, thats what I (tried to) mean, that we need to attach before signing :D

Bit slow this morning coffee

yup no worries, is just for reference for who is picking up this card

[mudler]

doesn't really work