store sbom result on OCI registry along with an image

[developer-guy]

store sbom result on OCI registry along with an image

[ribbybibby]

Could be useful, however.

I think it would be, yep.

For the use case I'm thinking about, I'd like to generate SBOMs for all the images I'm running in Kube and store them in a single repository (i.e example.com/myorg/sboms).

Then I can download any SBOM with cosign thusly:

COSIGN_REPOSITORY=example.com/myorg/sboms cosign download sbom prom/prometheus:v2.30.0

[ckotzbauer]

Yes, that would be a great feature for this project. Any PRs are welcome for this topic.

[ckotzbauer]

Hi @developer-guy, that sounds really interesting. But that only would make sense for "own" images, where you have write-permissions to store those SBOMs along with the image, right?

[developer-guy]

exactly! great catch ❤️

[ribbybibby]

But that only would make sense for "own" images, where you have write-permissions to store those SBOMs along with the image, right?

Not necessarily. Cosign supports the option to store the SBOM in a different repository to the target image.

[ckotzbauer]

Yes, correct. But that would store all sboms in one repo without its images. Could be useful, however.