From 1f1a21b3cfb545baa85e08e4e5d7f52d41b6aedc Mon Sep 17 00:00:00 2001 From: Dmitriy Ivolgin Date: Mon, 17 Aug 2026 12:48:56 -0700 Subject: [PATCH] Fix SBOM generation (#2109) --- .github/workflows/release.yaml | 2 ++ Makefile | 3 ++- README.md | 13 +++---------- 3 files changed, 7 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index fddd567d..ed369e7f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -29,6 +29,8 @@ jobs: - name: Install Cosign uses: sigstore/cosign-installer@v4.1.2 + with: + cosign-release: 'v3.1.3' - name: Generate and sign SBOM run: make sbom diff --git a/Makefile b/Makefile index 0476f303..862d1ab4 100644 --- a/Makefile +++ b/Makefile @@ -246,7 +246,8 @@ sbom: sbom/assets/troubleshoot-sbom.tgz --tlog-upload \ --yes \ --rekor-url=https://rekor.sigstore.dev \ - sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig + --bundle sbom/assets/troubleshoot-sbom.tgz.bundle \ + sbom/assets/troubleshoot-sbom.tgz cosign public-key --key cosign.key --outfile sbom/assets/key.pub .PHONY: get-govulncheck diff --git a/README.md b/README.md index 9695c117..dbaa086d 100644 --- a/README.md +++ b/README.md @@ -56,19 +56,12 @@ For questions about using Troubleshoot, how to contribute and engaging with the # Software Bill of Materials A signed SBOM that includes Troubleshoot dependencies is included in each release. - **troubleshoot-sbom.tgz** contains a software bill of materials for Troubleshoot. -- **troubleshoot-sbom.tgz.sig** is the digital signature for troubleshoot-sbom.tgz +- **troubleshoot-sbom.tgz.bundle** contains the signature and transparency log material used by Cosign. - **key.pub** is the public key from the key pair used to sign troubleshoot-sbom.tgz The following example illustrates using [cosign](https://github.com/sigstore/cosign) to verify that **troubleshoot-sbom.tgz** has -not been tampered with. +not been tampered with. Install [Cosign v3](https://github.com/sigstore/cosign/releases). ```sh -$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz -Verified OK -``` - -If you were to get an error similar to the one below, it means you are verifying an SBOM signed using cosign `v1` using a newer `v2` of the binary. This version introduced [breaking changes](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md#breaking-changes) which require an additional flag `--insecure-ignore-tlog=true` to successfully verify SBOMs like so. -```sh -$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz --insecure-ignore-tlog=true -WARNING: Skipping tlog verification is an insecure practice that lacks of transparency and auditability verification for the blob. +$ cosign verify-blob --key key.pub --bundle troubleshoot-sbom.tgz.bundle troubleshoot-sbom.tgz Verified OK ```