oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 07:26:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: update attestation code to remove library dependencies and shellout for keyless flow (#1442)

Browse Source 
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
This commit is contained in:
Christopher Angelo Phillips
2023-01-12 17:22:05 +00:00
committed by GitHub
co-authored by Alex Goodman
parent ac8f72fdd1
commit 44e8ae2577
23 changed files with 345 additions and 2025 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2
View File
@@ -367,6 +367,8 @@ syft convert sbom.syft.json -o cyclonedx-json=sbom.cdx.json # convert it to Cyc
### Keyless support
Syft supports generating attestations using cosign's [keyless](https://github.com/sigstore/cosign/blob/main/KEYLESS.md) signatures.
Note: users need to have >= v1.12.0 of cosign installed for this command to function
To use this feature with a format like CycloneDX json simply run:
```
syft attest --output cyclonedx-json <IMAGE WITH OCI WRITE ACCESS>