From 8ade15ef22c6b4ba19a0dd33b2ee541f8d5c3526 Mon Sep 17 00:00:00 2001
From: kranurag7 <anurag.kumar@syself.com>
Date: Mon, 4 Mar 2024 17:02:49 +0530
Subject: [PATCH] use cosign attest and upgrade bom

Signed-off-by: kranurag7 <anurag.kumar@syself.com>
---
 .github/workflows/release.yaml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7ff0d83a..6b70aff9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -49,7 +49,7 @@ jobs:
       - name: Install Bom
         shell: bash
         run: |
-          curl -L https://github.com/kubernetes-sigs/bom/releases/download/v0.4.1/bom-linux-amd64 -o bom
+          curl -L https://github.com/kubernetes-sigs/bom/releases/download/v0.6.0/bom-amd64-linux -o bom
           sudo mv ./bom /usr/local/bin/bom
           sudo chmod +x /usr/local/bin/bom
 
@@ -77,8 +77,6 @@ jobs:
 
 
       - name: Sign Container Images
-        env:
-          COSIGN_EXPERIMENTAL: "true"
         run: |
           cosign sign --yes ghcr.io/sovereigncloudstack/cspo@${{ steps.docker_build_release_cspo.outputs.digest }}
 
@@ -87,16 +85,14 @@ jobs:
         # To-Do: generate SBOM from source after https://github.com/kubernetes-sigs/bom/issues/202 is fixed
         # To-Do: format SBOM output to json after cosign v2.0 is released with https://github.com/sigstore/cosign/pull/2479
         run: |
-          bom generate -o sbom_ci_main_cspo_${{ steps.metacspo.outputs.version }}.spdx \
+          bom generate -o sbom_ci_main_cspo_${{ steps.metacspo.outputs.version }}-spdx.json \
           --image=ghcr.io/sovereigncloudstack/cspo:${{ steps.metacspo.outputs.version }}
 
       - name: Attach SBOM to Container Images cspo
         run: |
-          cosign attach sbom --sbom sbom_ci_main_cspo_${{ steps.metacspo.outputs.version }}.spdx ghcr.io/sovereigncloudstack/cspo@${{ steps.docker_build_release_cspo.outputs.digest }}
+          cosign attest --yes --type=spdxjson --predicate sbom_ci_main_cspo_${{ steps.metacspo.outputs.version }}-spdx.json ghcr.io/sovereigncloudstack/cspo@${{ steps.docker_build_release_cspo.outputs.digest }}
 
       - name: Sign SBOM Images cspo
-        env:
-          COSIGN_EXPERIMENTAL: "true"
         run: |
           docker_build_release_digest="${{ steps.docker_build_release_cspo.outputs.digest }}"
           image_name="ghcr.io/sovereigncloudstack/cspo:${docker_build_release_digest/:/-}.sbom"