From 53d21ba86f2e9978928dae43ba062b1c66e6a7cd Mon Sep 17 00:00:00 2001 From: Alex Kantor Date: Tue, 15 Sep 2026 12:02:21 +0100 Subject: [PATCH] ci(kosli): attest SBOMs with the sbom type Three SBOM attestations move off the generic and custom types. The sbom type is in production and v2.41.0 carries the command, which the org-wide KOSLI_CLI_VERSION of 2 already installs. docker.yml container-sbom was attest generic binary_provenance.yml sbom was attest generic binary_provenance.yml cyclone-dx-sbom was attest custom cyclone-dx-1-6 The generic ones carried the document only as an opaque attachment. The custom one sent it as attestation data. The sbom type takes the file with --sbom-file and reads the format, creation time, tools, subject and package count out of it, so the trail shows what the document says rather than a blob you have to download. Names and external URLs are unchanged, so existing template slots and anything referring to them keep matching. Fifteen template slots that receive these move from generic to "*": one in main-flow-template.yml, fourteen in release-flow-template.yml. Both files are applied by init_kosli.yml with kosli create flow --template-file, an upsert on every run, so a slot naming only sbom would refuse the old shape from a run still in flight. main.yml cancels concurrent runs per branch so that window is short; release.yml does not cancel, and two overlapping releases would hit it. Narrowing to sbom is the follow-up once nothing reports the old shapes. The cyclone-dx-1-6 custom type is still created elsewhere. Old trails reference it, so removing it is a separate decision. The type is behind the per-organisation flag is-sbom-attestation-enabled. Alex confirms it is on for kosli-public, which both workflows report to; not independently verified here. search: grep -rn "kosli attest" .github/workflows/ read in full. An earlier search of mine piped 31 matching lines through head -8 and missed binary_provenance.yml entirely. verified: ran the released binary with the exact flag set these workflows use, against a real SPDX fixture. It accepted --fingerprint, --name, --sbom-file, --external-url, --flow, --trail and --org, parsed the file, and failed only on the deliberately invalid token. mutation: not applicable, no test asserted here Co-Authored-By: Claude Opus 5 --- .github/workflows/binary_provenance.yml | 9 ++++---- .github/workflows/docker.yml | 4 ++-- main-flow-template.yml | 2 +- release-flow-template.yml | 28 ++++++++++++------------- 4 files changed, 21 insertions(+), 22 deletions(-) diff --git a/.github/workflows/binary_provenance.yml b/.github/workflows/binary_provenance.yml index 378a789ed..9f553534c 100644 --- a/.github/workflows/binary_provenance.yml +++ b/.github/workflows/binary_provenance.yml @@ -122,12 +122,12 @@ jobs: env: KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }} run: - kosli attest generic + kosli attest sbom --flow ${{ inputs.flow_name }} --trail ${{ inputs.trail_name }} --name sbom --fingerprint ${{ env.FINGERPRINT }} - --attachments ${{matrix.artifact.template_name}}-sbom.spdx.json + --sbom-file ${{matrix.artifact.template_name}}-sbom.spdx.json --external-url sigstore=https://search.sigstore.dev/?logIndex=${{ env.SBOM_TLOG_INDEX }} --org ${{ inputs.kosli_org }} @@ -135,13 +135,12 @@ jobs: env: KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }} run: - kosli attest custom + kosli attest sbom --flow ${{ inputs.flow_name }} --trail ${{ inputs.trail_name }} --name cyclone-dx-sbom - --type cyclone-dx-1-6 --fingerprint ${{ env.FINGERPRINT }} - --attestation-data ${{matrix.artifact.template_name}}-sbom.cyclonedx.json + --sbom-file ${{matrix.artifact.template_name}}-sbom.cyclonedx.json --org ${{ inputs.kosli_org }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 7f00249d4..b0c865e97 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -327,12 +327,12 @@ jobs: env: KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }} run: - kosli attest generic + kosli attest sbom --flow ${{ inputs.flow_name }} --trail ${{ inputs.trail_name }} --name container-sbom --fingerprint ${{ env.FINGERPRINT }} - --attachments sbom.spdx.json + --sbom-file sbom.spdx.json --org ${{ inputs.kosli_org }} - name: Run Snyk Container Test to scan the Docker image for vulnerabilities diff --git a/main-flow-template.yml b/main-flow-template.yml index 419f8f3a2..f84352ef3 100644 --- a/main-flow-template.yml +++ b/main-flow-template.yml @@ -23,4 +23,4 @@ trail: - name: smoke-test type: generic - name: container-sbom - type: generic + type: "*" diff --git a/release-flow-template.yml b/release-flow-template.yml index b3124fd19..b634df233 100644 --- a/release-flow-template.yml +++ b/release-flow-template.yml @@ -17,59 +17,59 @@ trail: - name: smoke-test type: generic - name: container-sbom - type: generic + type: "*" - name: linux-arm attestations: - name: sbom - type: generic + type: "*" - name: windows-arm64 attestations: - name: sbom - type: generic + type: "*" - name: darwin-arm64 attestations: - name: sbom - type: generic + type: "*" - name: linux-arm64 attestations: - name: sbom - type: generic + type: "*" - name: linux-amd64 attestations: - name: sbom - type: generic + type: "*" - name: windows-amd64 attestations: - name: sbom - type: generic + type: "*" - name: darwin-amd64 attestations: - name: sbom - type: generic + type: "*" - name: rpm-pkg-amd64 attestations: - name: sbom - type: generic + type: "*" - name: rpm-pkg-arm64 attestations: - name: sbom - type: generic + type: "*" - name: rpm-pkg-arm attestations: - name: sbom - type: generic + type: "*" - name: deb-pkg-arm64 attestations: - name: sbom - type: generic + type: "*" - name: deb-pkg-arm attestations: - name: sbom - type: generic + type: "*" - name: deb-pkg-amd64 attestations: - name: sbom - type: generic + type: "*"