Hi @jjbustamante , @natalieparellano, before you go ahead with reviewing this PR, I had a query to clear off my head. Since we are doing a multi-platform image build using buildx, should the cosign sign and cosign attest (for sbom) be done individually for every platform arch image manifest digest or the entire multi-platform index digest as a whole?

@adwait-godbole thank you for this. I'd recommend we do this similarly to how we do it in the lifecycle, you can find the workflow file here: https://github.com/buildpacks/lifecycle/blob/main/.github/workflows/build.yml

The sbom that we attach to the release on GitHub is from linux-amd64. But the sbom that we embed within the lifecycle image is for the particular os/arch that we're shipping (see here). But, since we don't have the concept of sbom-within-the-image for pack, we can probably skip over this.