bug: remove chance for panic; provide default attestation path (#1214)

Signed-off-by: Christopher Phillips <[email protected]>

cmd/syft/cli/attest/attest.go

@@ -70,7 +70,14 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 		return err
 	}
 
-	format := syft.FormatByName(app.Outputs[0])
+	output := parseAttestationOutput(app.Outputs)
+
+	format := syft.FormatByName(output)
+
+	// user typo or unknown outputs provided
+	if format == nil {
+		format = syft.FormatByID(syftjson.ID) // default attestation format
+	}
 	predicateType := formatPredicateType(format)
 	if predicateType == "" {
 		return fmt.Errorf(
@@ -109,6 +116,14 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	)
 }
 
+func parseAttestationOutput(outputs []string) (format string) {
+	if len(outputs) == 0 {
+		outputs = append(outputs, string(syftjson.ID))
+	}
+
+	return outputs[0]
+}
+
 func parseImageSource(userInput string, app *config.Application) (s *source.Input, err error) {
 	si, err := source.ParseInput(userInput, app.Platform, false)
 	if err != nil {

test/cli/attest_cmd_test.go

@@ -40,6 +40,14 @@ func TestAttestCmd(t *testing.T) {
 			},
 			pw: "",
 		},
+		{
+			name: "can encode syft.json as the predicate given a user format typo",
+			args: []string{"attest", "-o", "spdx-jsonx", "--key", "cosign.key", img},
+			assertions: []traitAssertion{
+				assertSuccessfulReturnCode,
+			},
+			pw: "",
+		},
 	}
 
 	for _, test := range tests {