Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

main.go:74: error during command execution: signing **image:tag**: provenance predicate: required field builder missing #3757

Open
blueacidification opened this issue Jul 2, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@blueacidification
Copy link

blueacidification commented Jul 2, 2024

Description

I generate my provenance.json file. When i execute
cosign attest --yes --predicate provenance.json --type slsaprovenance --key cosign.key image:tag the command fails and says provenance predicate: required field builder missing.

I use a similar command for my sbom file and that works just fine.

{
"_type": "https://in-toto.io/Statement/v0.1",
"predicateType": "https://slsa.dev/provenance/v0.2",
"subject": [
{
"name": "",
"digest": {
"sha256": "
"
}
}],
"predicate": {
"builder": {
"id": "mailto:@.al"
},
"buildType": "https://mobyproject.org/buildkit@v1",
***
}
}

This is the general outline of the file after generated from buildx.

Version

2.2.4

@blueacidification blueacidification added the bug Something isn't working label Jul 2, 2024
@blueacidification
Copy link
Author

Seems like the issue is that it expects builder and buildtype outside of predicate, which worked for me. Even tho the official slsa provenance schema has it inside predicte https://slsa.dev/spec/v0.2/provenance#schema

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants
@blueacidification and others