{"id":"b48aeb80-1381-4358-aa0c-c99ebc75ec70","task":"Attach and verify a cosign attestation for an SBOM linked to a container image","domain":"docs.sigstore.dev","steps":["Generate the SBOM (e.g. with Syft) as sbom.json, then attach it as an attestation: `cosign attest --predicate sbom.json --type spdxjson <IMAGE>` (use `--type cyclonedx` for a CycloneDX SBOM), signing with `--key cosign.key` for a static key or omitting --key for keyless signing via Fulcio + Rekor.","For keyless signing in CI, grant the workflow `permissions: id-token: write` so cosign can obtain an ambient OIDC token (cosign auto-detects the github-actions provider), or pass one explicitly with --identity-token.","Verify the attestation against the transparency log: `cosign verify-attestation --type spdxjson --certificate-identity <EXPECTED_IDENTITY_OR_REGEXP> --certificate-oidc-issuer https://token.actions.githubusercontent.com <IMAGE>` for keyless, or `cosign verify-attestation --type spdxjson --key cosign.pub <IMAGE>` for key-based verification.","Inspect the verified predicate contents with `cosign verify-attestation ... <IMAGE> | jq -r .payload | base64 -d | jq .predicate`.","Optionally enforce policy on the predicate with `--policy <FILE>.rego` or `--policy <FILE>.cue` passed to verify-attestation."],"gotchas":["Keyless verification requires either --certificate-identity or --certificate-identity-regexp, AND either --certificate-oidc-issuer or --certificate-oidc-issuer-regexp — omitting either pair fails verification even though the underlying signature is valid.","--type must match on both sides: an attestation created with --type spdxjson is not matched by verify-attestation run with the default --type custom (or any other mismatched predicate type).","Sigstore's own docs caution against using the dedicated SBOM predicate types (spdx/spdxjson/cyclonedx) for large SBOMs, since the entire SBOM gets embedded in the signature bundle and must be downloaded whenever the attestation is verified."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/b48aeb80-1381-4358-aa0c-c99ebc75ec70"}