@@ -48,7 +48,7 @@ docker-publish:
48
48
# Uses the keyless signing flow with Github Actions as identity provider\
49
49
cosign sign -y " ${DOCKER_REPO} /${ORGANIZATION} /${OPERATOR_NAME} @$$ REPO_DIGEST_OF_IMAGE" ; \
50
50
# Generate the SBOM for the operator image, this leverages the already generated SBOM for the operator binary by cargo-cyclonedx\
51
- syft scan --output cyclonedx-json=sbom.json --select-catalogers " -cargo-auditable-binary-cataloger" --scope all-layers --source-name " ${OPERATOR_NAME} " --source-version " ${VERSION} -${ARCH} " " ${DOCKER_REPO} /${ORGANIZATION} /${OPERATOR_NAME} @$$ REPO_DIGEST_OF_IMAGE" ; \
51
+ syft scan --output cyclonedx-json@1.5 =sbom.json --select-catalogers " -cargo-auditable-binary-cataloger,+sbom -cataloger" --scope all-layers --source-name " ${OPERATOR_NAME} " --source-version " ${VERSION} -${ARCH} " " ${DOCKER_REPO} /${ORGANIZATION} /${OPERATOR_NAME} @$$ REPO_DIGEST_OF_IMAGE" ; \
52
52
# Determine the PURL for the container image\
53
53
URLENCODED_REPO_DIGEST_OF_IMAGE=$$(echo "$$REPO_DIGEST_OF_IMAGE" | sed 's/:/%3A/g' ) ; \
54
54
PURL=" pkg:oci/${OPERATOR_NAME} @$$ URLENCODED_REPO_DIGEST_OF_IMAGE?arch=${ARCH} &repository_url=${DOCKER_REPO} %2F${ORGANIZATION} %2F${OPERATOR_NAME} " ; \
@@ -74,7 +74,7 @@ docker-publish:
74
74
# Uses the keyless signing flow with Github Actions as identity provider\
75
75
cosign sign -y "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
76
76
# Generate the SBOM for the operator image, this leverages the already generated SBOM for the operator binary by cargo-cyclonedx\
77
- syft scan --output cyclonedx-json=sbom.json --select-catalogers "-cargo-auditable-binary-cataloger" --scope all-layers --source-name "${OPERATOR_NAME}" --source-version "${VERSION}-${ARCH}" "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
77
+ syft scan --output cyclonedx-json@1.5 =sbom.json --select-catalogers "-cargo-auditable-binary-cataloger,+sbom -cataloger" --scope all-layers --source-name "${OPERATOR_NAME}" --source-version "${VERSION}-${ARCH}" "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
78
78
# Determine the PURL for the container image\
79
79
URLENCODED_REPO_DIGEST_OF_IMAGE=$$(echo "$$REPO_DIGEST_OF_IMAGE" | sed 's/:/%3A/g');\
80
80
PURL="pkg:oci/${OPERATOR_NAME}@$$URLENCODED_REPO_DIGEST_OF_IMAGE?arch=${ARCH}&repository_url=${OCI_REGISTRY_HOSTNAME}%2F${OCI_REGISTRY_PROJECT_IMAGES}%2F${OPERATOR_NAME}";\
0 commit comments