Attestation with a private key

[TomiOhl]

What happened:
The readme still has the steps using the now removed --key flag.
Relevant parts:

• Local private key support
• Adding an SBOM to an image as an attestation using Syft

What you expected to happen:
The readme should be updated to reflect the breaking changes between v0.65.0 and v0.66.0. Trying to run the given command results in the following error: error during command execution: unknown flag: --key. I'd appreciate up-to-date steps.

Anything else we need to know?:
If the problem is on my side and the readme is correct, let me know and I'll provide more relevant feedback.

[ReDemoNBR]

I have similar issue in my CI environment that has the key stored in the secrets.
I'm looking for updated steps for the attestation.

If needed, I can be available to help

[tgerla]

Hi @TomiOhl and @ReDemoNBR, thanks for catching this. We will have an updated README and a new way to specify a private key in the next release of Syft. Stay tuned--for the time being you can go back to Syft 0.66.0. There's some additional information about the change here: #1442

Hope this helps and sorry for the trouble!

[spiffcs]

@TomiOhl I've merged a new change that's unreleased but on the tip of main. Let me know if this is still behaving incorrectly to your expectations.

I can also reopen the issue or file a new one if there are other asks surrounding this workflow. Thanks again!

Tested with: