ci: use cosign attest directly instead of syft attest

edgelesssys · Feb 21, 2023 · d3206ec · d3206ec
1 parent b4b2f0e
commit d3206ec
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/.github/actions/container_sbom/action.yml b/.github/actions/container_sbom/action.yml
@@ -31,10 +31,10 @@ runs:
         COSIGN_PUBLIC_KEY: ${{ inputs.cosignPublicKey }}
         COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
         COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
-        SYFT_ATTEST_PASSWORD: ${{ inputs.cosignPassword }} # Required for Syft 0.69.0+ as they overwrite COSIGN_PASSWORD
       run: |
         set -ex
-        syft attest --key env://COSIGN_PRIVATE_KEY ${{ inputs.containerReference }} -o cyclonedx-json > container-image.att.json
+        syft packages ${{ inputs.containerReference }} -o cyclonedx-json > container-image-predicate.json
+        cosign attest --key env://COSIGN_PRIVATE_KEY --predicate container-image-predicate.json --type cyclonedx > container-image.att.json
         cosign attach attestation ${{ inputs.containerReference }} --attestation container-image.att.json
         # TODO: type should be auto-discovered after issue is resolved:
         # https://github.com/sigstore/cosign/issues/2264