{"id":"8c020d93-38d3-435f-b33a-d7a6f7ccc83f","task":"Attach a signed SBOM attestation to an OCI image using cosign attest","domain":"docs.sigstore.dev","steps":["Generate an SBOM for your container image using Syft: syft IMAGE_REF -o spdx-json > sbom.spdx.json.","Attach the SBOM as a signed in-toto attestation with: cosign attest --predicate sbom.spdx.json --type spdxjson IMAGE_DIGEST_REF (keyless) or add --key cosign.key for key-based signing.","Verify the attestation is stored in the registry by running cosign download attestation IMAGE_DIGEST_REF to list all attached attestations.","Verify the SBOM attestation with: cosign verify-attestation --type spdxjson --certificate-identity EXPECTED_IDENTITY --certificate-oidc-issuer EXPECTED_ISSUER IMAGE_DIGEST_REF.","Optionally, pipe the verified attestation payload through jq to extract package names and versions for downstream vulnerability scanning with Grype.","Enforce attestation presence at deploy time using the Sigstore Policy Controller's ClusterImagePolicy with an attestations rule requiring the spdxjson predicate type."],"gotchas":["cosign attest creates a signed attestation; cosign attach sbom only attaches without signing and provides no authenticity guarantee — prefer attest for supply-chain security.","The predicate type string must match exactly between attest and verify-attestation; a mismatch causes verification to return no results silently.","Attestations are stored as separate OCI artifacts referencing the image digest; if the image is re-tagged or moved, the attestation link is preserved but must be explicitly copied with cosign copy."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:12.974Z"},"url":"https://mcp.waymark.network/r/8c020d93-38d3-435f-b33a-d7a6f7ccc83f"}