chore: attest multiarch deps properly

download and attest the sbom for images by architecture
FlatTrackio · Feb 23, 2025 · 917f924 · 917f924
1 parent 6822436
commit 917f924
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -65,7 +65,7 @@ variables:
   before_script:
     - set -x
     - *setup-testing-repo
-    - apk add --no-cache curl cosign ko git crane
+    - apk add --no-cache curl cosign ko git crane jq
     - export KO_DOCKER_REPO="$(echo ${KO_DOCKER_REPO} | tr '[:upper:]' '[:lower:]')"
     - ko login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
     - *image-set-build-env

diff --git a/hack/publish.sh b/hack/publish.sh
@@ -54,8 +54,14 @@ IMAGE="$(ko publish \
 
 if [ "${SIGN:-}" = true ]; then
     cosign sign --recursive -y "$IMAGE"
-    cosign download sbom "$IMAGE" > /tmp/sbom-spdx.json
+    cosign download sbom "$IMAGE" >/tmp/sbom-spdx.json
     cosign attest -y --recursive --predicate /tmp/sbom-spdx.json "$IMAGE"
+
+    DIGESTS="$(crane manifest "$IMAGE" | jq -r .manifests[].digest)"
+    for DIGEST in $DIGESTS; do
+        cosign download sbom "$KO_DOCKER_REPO@$DIGEST" >/tmp/sbom-spdx-"$DIGEST".json
+        cosign attest -y --recursive --predicate /tmp/sbom-spdx-"$DIGEST".json "$KO_DOCKER_REPO@$DIGEST"
+    done
 fi
 
 if [ "${TEST_TARBALL:-}" = true ]; then