fix: update attestation code to remove library dependencies and shellout for keyless flow (#1442)

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

syft/sbom/multi_writer.go

@@ -99,6 +99,18 @@ func (m *multiWriter) Write(s SBOM) (errs error) {
 	return errs
 }
 
+// Bytes returns the bytes of the SBOM that would be written
+func (m *multiWriter) Bytes(s SBOM) (bytes []byte, err error) {
+	for _, w := range m.writers {
+		b, err := w.Bytes(s)
+		if err != nil {
+			return nil, err
+		}
+		bytes = append(bytes, b...)
+	}
+	return bytes, nil
+}
+
 // Close closes all writers
 func (m *multiWriter) Close() (errs error) {
 	for _, w := range m.writers {

syft/sbom/stream_writer.go

@@ -1,6 +1,7 @@
 package sbom
 
 import (
+	"bytes"
 	"io"
 )
 
@@ -16,6 +17,16 @@ func (w *streamWriter) Write(s SBOM) error {
 	return w.format.Encode(w.out, s)
 }
 
+// Bytes returns the bytes of the SBOM that would be written
+func (w *streamWriter) Bytes(s SBOM) ([]byte, error) {
+	var buffer bytes.Buffer
+	err := w.format.Encode(&buffer, s)
+	if err != nil {
+		return nil, err
+	}
+	return buffer.Bytes(), nil
+}
+
 // Close any resources, such as open files
 func (w *streamWriter) Close() error {
 	if w.close != nil {

syft/sbom/writer.go

@@ -7,6 +7,9 @@ type Writer interface {
 	// Write writes the provided SBOM
 	Write(SBOM) error
 
+	// Bytes returns the bytes of the SBOM that would be written
+	Bytes(SBOM) ([]byte, error)
+
 	// Closer a resource cleanup hook which will be called after SBOM
 	// is written or if an error occurs before Write is called
 	io.Closer