Add support for syft json type to cosign

Signed-off-by: Sambhav Kothari <[email protected]>
sigstore · Dec 5, 2021 · 5a8e573 · 5a8e573
1 parent e233ce8
commit 5a8e573
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/cmd/cosign/cli/options/attach.go b/cmd/cosign/cli/options/attach.go
@@ -61,7 +61,7 @@ func (o *AttachSBOMOptions) AddFlags(cmd *cobra.Command) {
 		"path to the sbom, or {-} for stdin")
 
 	cmd.Flags().StringVar(&o.SBOMType, "type", "spdx",
-		"type of sbom (spdx|cyclonedx)")
+		"type of sbom (spdx|cyclonedx|syft)")
 }
 
 func (o *AttachSBOMOptions) MediaType() (types.MediaType, error) {
@@ -70,7 +70,9 @@ func (o *AttachSBOMOptions) MediaType() (types.MediaType, error) {
 		return ctypes.CycloneDXMediaType, nil
 	case "spdx":
 		return ctypes.SPDXMediaType, nil
+	case "syft":
+		return ctypes.SyftMediaType, nil
 	default:
-		return "unknown", fmt.Errorf("unknown SBOM type: %q, expected (spdx|cyclonedx)", o.SBOMType)
+		return "unknown", fmt.Errorf("unknown SBOM type: %q, expected (spdx|cyclonedx|syft)", o.SBOMType)
 	}
 }
diff --git a/doc/cosign_attach_sbom.md b/doc/cosign_attach_sbom.md
diff --git a/pkg/types/media.go b/pkg/types/media.go
@@ -17,6 +17,7 @@ package types
 
 const (
 	CycloneDXMediaType     = "application/vnd.cyclonedx"
+	SyftMediaType          = "application/vnd.syft"
 	SimpleSigningMediaType = "application/vnd.dev.cosign.simplesigning.v1+json"
 	SPDXMediaType          = "text/spdx"
 	WasmLayerMediaType     = "application/vnd.wasm.content.layer.v1+wasm"