diff --git a/specs/SBOM_SPEC.md b/specs/SBOM_SPEC.md index 782ef04f328..9ba685de570 100644 --- a/specs/SBOM_SPEC.md +++ b/specs/SBOM_SPEC.md @@ -101,13 +101,14 @@ In this example, the SBOM only refers to a single layer: ## MediaTypes -The two main SBOM formats in use are [SPDX](https://spdx.org) and [CycloneDX](https://cyclonedx.org/). +The SBOM formats supported by cosign are [SPDX](https://spdx.org), [CycloneDX](https://cyclonedx.org/) and [syft](https://github.com/anchore/syft). The `mediaTypes` for these should be indicated in the `descriptor` for each `layer`. The `mediaTypes` are: * `application/vnd.cyclonedx` * `text/spdx` +* `application/vnd.syft+json` (`syft` is a JSON only format) These `mediaTypes` can contain format-specific suffixes as well. For example: