510 - SBOM attestation stdout (#785)

add syft attest command to produce an attestation as application/vnd.in-toto+json to standard out using on disk PKI

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

test/cli/utils_test.go

@@ -14,6 +14,39 @@ import (
 	"github.com/anchore/stereoscope/pkg/imagetest"
 )
 
+func setupPKI(t *testing.T, pw string) func() {
+	err := os.Setenv("COSIGN_PASSWORD", pw)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cosignPath := filepath.Join(repoRoot(t), ".tmp/cosign")
+	cmd := exec.Command(cosignPath, "generate-key-pair")
+	stdout, stderr := runCommand(cmd, nil)
+	if cmd.ProcessState.ExitCode() != 0 {
+		t.Log("STDOUT", stdout)
+		t.Log("STDERR", stderr)
+		t.Fatalf("could not generate keypair")
+	}
+
+	return func() {
+		err := os.Unsetenv("COSIGN_PASSWORD")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		err = os.Remove("cosign.key")
+		if err != nil {
+			t.Fatalf("could not cleanup cosign.key")
+		}
+
+		err = os.Remove("cosign.pub")
+		if err != nil {
+			t.Fatalf("could not cleanup cosign.key")
+		}
+	}
+}
+
 func getFixtureImage(t testing.TB, fixtureImageName string) string {
 	t.Logf("obtaining fixture image for %s", fixtureImageName)
 	imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)