510 - SBOM attestation stdout (#785)

add syft attest command to produce an attestation as application/vnd.in-toto+json to standard out using on disk PKI

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

internal/config/application.go

@@ -45,6 +45,7 @@ type Application struct {
 	Secrets            secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
 	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
 	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
+	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
 }
 
 // PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command

internal/config/attest.go

@@ -0,0 +1,29 @@
+package config
+
+import (
+	"os"
+
+	"github.com/spf13/viper"
+)
+
+type attest struct {
+	Key string `yaml:"key" json:"key" mapstructure:"key"`
+	// IMPORTANT: do not show the password in any YAML/JSON output (sensitive information)
+	Password string `yaml:"-" json:"-" mapstructure:"password"`
+}
+
+//nolint:unparam
+func (cfg *attest) parseConfigValues() error {
+	if cfg.Password == "" {
+		// we allow for configuration via syft config/env vars and additionally interop with known cosign config env vars
+		if pw, ok := os.LookupEnv("COSIGN_PASSWORD"); ok {
+			cfg.Password = pw
+		}
+	}
+
+	return nil
+}
+
+func (cfg attest) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("attest.password", "")
+}

internal/input.go

@@ -18,3 +18,9 @@ func IsPipedInput() (bool, error) {
 	// if there *may* be bytes that will show up on stdin that should be used for the analysis source.
 	return fi.Mode()&os.ModeNamedPipe != 0, nil
 }
+
+// IsTerminal returns true if there is a terminal present.
+func IsTerminal() bool {
+	stat, _ := os.Stdin.Stat()
+	return (stat.Mode() & os.ModeCharDevice) != 0
+}