Update SBOM spec to indicate compat for syft (sigstore#1278)

* Update SBOM spec to indicate compat for syft This documents the support for syft json added in sigstore#1137 Signed-off-by: Sambhav Kothari <[email protected]> * Reword SBOM wording to indicate that the formats are cosign specific As noted by @VinodAnandan - the previous message may have caused confusion about NTIA recorgnized formats v/s formats cosign uses. Updating the wording to explicitly call out cosign supported formats. Signed-off-by: Sambhav Kothari <[email protected]>
mlieberman85 · May 6, 2022 · db99f3a · db99f3a
1 parent d1baed2
commit db99f3a
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/specs/SBOM_SPEC.md b/specs/SBOM_SPEC.md
@@ -101,13 +101,14 @@ In this example, the SBOM only refers to a single layer:
 
 ## MediaTypes
 
-The two main SBOM formats in use are [SPDX](https://spdx.org) and [CycloneDX](https://cyclonedx.org/).
+The SBOM formats supported by cosign are [SPDX](https://spdx.org), [CycloneDX](https://cyclonedx.org/) and [syft](https://github.com/anchore/syft).
 The `mediaTypes` for these should be indicated in the `descriptor` for each `layer`.
 
 The `mediaTypes` are:
 
 * `application/vnd.cyclonedx`
 * `text/spdx`
+* `application/vnd.syft+json` (`syft` is a JSON only format)
 
 These `mediaTypes` can contain format-specific suffixes as well. For example: