chore: add warn when attaching sBOM (#1756)

Signed-off-by: hectorj2f <[email protected]>
sigstore · Apr 14, 2022 · 70a3d8c · 70a3d8c
1 parent 9516998
commit 70a3d8c
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/cmd/cosign/cli/attach.go b/cmd/cosign/cli/attach.go
@@ -16,6 +16,9 @@
 package cli
 
 import (
+	"fmt"
+	"os"
+
 	"github.com/sigstore/cosign/cmd/cosign/cli/attach"
 	"github.com/sigstore/cosign/cmd/cosign/cli/options"
 	"github.com/spf13/cobra"
@@ -67,6 +70,7 @@ func attachSBOM() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			fmt.Fprintf(os.Stderr, "WARNING: Attaching SBOMs this way does not sign them. If you want to sign them, use 'cosign attest -predicate %s -key <key path>' or 'cosign sign -key <key path> <sbom image>'.\n", o.SBOM)
 			return attach.SBOMCmd(cmd.Context(), o.Registry, o.SBOM, mediaType, args[0])
 		},
 	}