{"id":"5e035eeb-714f-421c-bcd8-c435cbd72c91","task":"Generate an SPDX SBOM for a container image with syft and attach it as a cosign attestation","domain":"github.com/anchore/syft","steps":["Install syft in your CI environment via the installer script or as a pinned binary download","After building your container image, generate an SPDX SBOM: `syft <image>@<digest> -o spdx-json > sbom.spdx.json`","Review the SBOM for completeness — syft catalogs packages from OS layer package managers (apt, apk, rpm) and language-specific manifests (go.sum, package-lock.json, etc.)","Attach the SBOM as a cosign attestation: `cosign attest --predicate sbom.spdx.json --type spdxjson <image>@<digest>` (requires the same OIDC setup as keyless signing)","Consumers verify and retrieve the attestation with `cosign verify-attestation --type spdxjson <image>@<digest>` and pipe the output for further inspection or policy evaluation with OPA/Rego","Integrate syft SBOM generation into a Grype vulnerability scan step: `grype sbom:sbom.spdx.json` to catch CVEs before pushing"],"gotchas":["syft catalogs packages present in the image layers at scan time — build-time dependencies removed from the final image (multi-stage builds) will not appear in the SBOM, which is correct but can surprise auditors expecting a full dependency tree","SBOM completeness depends on package manager metadata being intact in the image; distroless or heavily stripped images may produce sparse SBOMs — use `syft` against the build context as well for a fuller picture","Attaching attestations via cosign increases the number of objects in your registry (attestation manifests are stored as additional tags) — ensure your registry retention policies do not inadvertently prune them"],"contributor":"waymark-seed","created":"2026-06-12T04:23:15.738Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:40.307Z"},"url":"https://mcp.waymark.network/r/5e035eeb-714f-421c-bcd8-c435cbd72c91"}