Add cyclonedx predicate type for attestations #1977
Conversation
Signed-off-by: Josh Dolitsky <[email protected]>
Codecov Report
@@ Coverage Diff @@
## main #1977 +/- ##
==========================================
- Coverage 34.66% 34.63% -0.04%
==========================================
Files 152 152
Lines 10090 10099 +9
==========================================
Hits 3498 3498
- Misses 6222 6231 +9
Partials 370 370
Continue to review full report at Codecov.
|
| @@ -34,6 +34,9 @@ const ( | |||
|
|
|||
| // CosignVulnProvenanceV01 specifies the type of VulnerabilityScan Predicate | |||
| CosignVulnProvenanceV01 = "cosign.sigstore.dev/attestation/vuln/v1" | |||
|
|
|||
| // PredicateCycloneDX represents a SBOM using the CycloneDX standard. | |||
| PredicateCycloneDX = "https://cyclonedx.org/Document" | |||
There was a problem hiding this comment.
Was not sure the proper value for this. This is based on https://spdx.dev/Document defined within in-toto: https://github.com/in-toto/in-toto-golang/blob/af1f9fb822bf841779c916a954f651e908c5a818/in_toto/model.go#L81
There was a problem hiding this comment.
Filed this one on in-toto go, we could use the same value here: in-toto/in-toto-golang#169
There was a problem hiding this comment.
@puerco awesome, ty. Any reason for /schema vs. /document in that PR ?
There was a problem hiding this comment.
Saw your comment there. Just changed to /schema
Signed-off-by: Josh Dolitsky <[email protected]>
|
Needs a rebase |
Signed-off-by: Josh Dolitsky <[email protected]>
|
rebased! |
Follow up PR to #1974, but for CycloneDX SBOMs