Failure When Attempting to Verify Attestation

[spiffcs]

Please provide a set of steps on how to reproduce the issue

What happened:
Generate an SBOM attestation for an image you have write access to for a given OCI registry:

syft attest -o syft-json caphill4/scratch:latest

Attempt to verify with latest cosign (v1.13.1)

Error: none of the attestations matched the predicate type: custom

What you expected to happen:
Verification to show the attestation was signed correctly by the keyless workflow.

Environment:

• Output of syft version:
  ``Application: syft
  Version: 0.62.2
  JsonSchemaVersion: 6.0.0
  BuildDate: 2022-11-28T16:44:33Z
  GitCommit: 0cbd0cc
  GitDescription: v0.62.2
  Platform: darwin/amd64
  GoVersion: go1.18.8
  Compiler: gc

[ep4sh]

Encountered the same issue:

Application:        syft
Version:            0.62.1
JsonSchemaVersion:  6.0.0
BuildDate:          2022-11-21T14:52:44Z
GitCommit:          098e61dcc81d7a6d666bc62a2166c9b8f32c61bc
GitDescription:     v0.62.1
Platform:           linux/amd64
GoVersion:          go1.18.7
Compiler:           gc

cosign: A tool for Container Signing, Verification and Storage in an OCI registry.
GitVersion:    1.13.1
GitCommit:     d1c6336475b4be26bb7fb52d97f56ea0a1767f9f
GitTreeState:  "clean"
BuildDate:     2022-10-17T18:00:05Z
GoVersion:     go1.19.2
Compiler:      gc
Platform:      darwin/amd64

[spiffcs]

sigstore/cosign#2494 <-- Filed an upstream issue

[spiffcs]

@ep4sh this should be fixed as of #1442 - If you still have problems let me know and we can readdress the issue.