more debugging

shellz-n-stuff · Jun 23, 2024 · 8d7cdbb · 8d7cdbb
1 parent ae2f4c8
commit 8d7cdbb
Showing 1 changed file with 5 additions and 8 deletions.
diff --git a/.github/workflows/build_and_publish.yaml b/.github/workflows/build_and_publish.yaml
@@ -64,18 +64,15 @@ jobs:
     # SBOM generation and signing
     - name: Generate SBOM
       run: syft ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} -o json > sbom.json
-
-    - name: Sign SBOM with Cosign
-      env:
-        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-      run: |
-        cosign sign-blob --yes --key <(echo "${{ secrets.COSIGN_PRIVATE_KEY }}") sbom.json > sbom.json.sig
 
-    - name: Attach SBOM to Docker Image
+    - name: Attach SBOM to Docker Image and Submit a signature for the SBOM
       env:
         COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
       run: |
-        cosign attach sbom --sbom sbom.json --key <(echo "${{ secrets.COSIGN_PRIVATE_KEY }}") ${{ env.DIGEST }}
+        ATTACHED_SSBOM=$(cosign attach sbom --sbom sbom.json ${{ env.DIGEST }})
+        echo "${ATTACHED_SSBOM}"
+        cosign sign --yes --key <(echo "${{ secrets.COSIGN_PRIVATE_KEY }}") ${ATTACHED_SSBOM}
+
 
     # Scan Image then Sign if Okay
     - name: Run Trivy vulnerability scanner