510 - SBOM attestation stdout

[spiffcs]

Attestation Stdout

This PR adds the initial version of the syft attest command. A user can use attest to generate a summary of discovered packages formatted as the predicate to an image attestation.

To run this command you'll need to generate a key via cosign generate-key-pair. You can either pass it directly to the command or have syft read from the default location ./cosign.key

go run main.go attest --key cosign.key --output json anchore/syft:latest 

Notes:

• compile size increases from ~22mb --> ~60mb due to new library imports
• CI time has increased for static analysis
• keyless workflow will be added after; see here for outline of what is to come
• snapshot build times have increased with the introduction of new cosign libraries

TODO:

• update user input keysign options to be more friendly
• update to allow password inputs for keys
• inject command context to leverage correct cosign function signatures
• unit/integration coverage
• command coverage
• rebase
• BUG: keyreference panic found for certain keyoptions
• Question: Integration with SBOM writer/encoding pattern or keep write to stdout separate flow
• Question: static-analysis has increased to 4m beyond 2m timeout

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

name                                                       old time/op    new time/op    delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2              1.59ms ± 1%    1.28ms ± 1%  -19.15%  (p=0.008 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2            3.63ms ± 2%    2.93ms ± 0%  -19.39%  (p=0.016 n=5+4)
ImagePackageCatalogers/php-composer-installed-cataloger-2    1.26ms ± 3%    1.01ms ± 0%  -19.69%  (p=0.008 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2        1.00ms ± 5%    0.79ms ± 0%  -21.38%  (p=0.008 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                    1.16ms ± 1%    0.92ms ± 0%  -21.04%  (p=0.008 n=5+5)
ImagePackageCatalogers/rpmdb-cataloger-2                     1.04ms ± 3%    0.83ms ± 1%  -20.57%  (p=0.008 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      27.9ms ± 1%    22.4ms ± 1%  -19.62%  (p=0.008 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.58ms ± 4%    1.27ms ± 1%  -20.11%  (p=0.008 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2          2.42µs ± 1%    1.91µs ± 1%  -20.97%  (p=0.008 n=5+5)

name                                                       old alloc/op   new alloc/op   delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2               253kB ± 0%     252kB ± 0%     ~     (p=0.056 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2            1.06MB ± 0%    1.06MB ± 0%     ~     (p=1.000 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     253kB ± 0%     253kB ± 0%     ~     (p=0.095 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         208kB ± 0%     208kB ± 0%   -0.09%  (p=0.016 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                     254kB ± 0%     254kB ± 0%     ~     (p=1.000 n=5+5)
ImagePackageCatalogers/rpmdb-cataloger-2                      236kB ± 0%     236kB ± 0%   +0.13%  (p=0.016 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      4.20MB ± 0%    4.20MB ± 0%     ~     (p=0.548 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.30MB ± 0%    1.30MB ± 0%     ~     (p=0.421 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            608B ± 0%      608B ± 0%     ~     (all equal)

name                                                       old allocs/op  new allocs/op  delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2               6.33k ± 0%     6.33k ± 0%     ~     (all equal)
ImagePackageCatalogers/python-package-cataloger-2             21.4k ± 0%     21.4k ± 0%     ~     (p=0.143 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     7.25k ± 0%     7.25k ± 0%     ~     (p=1.000 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         5.36k ± 0%     5.36k ± 0%     ~     (all equal)
ImagePackageCatalogers/dpkgdb-cataloger-2                     7.10k ± 0%     7.10k ± 0%     ~     (all equal)
ImagePackageCatalogers/rpmdb-cataloger-2                      6.82k ± 0%     6.82k ± 0%     ~     (all equal)
ImagePackageCatalogers/java-cataloger-2                       86.8k ± 0%     86.8k ± 0%     ~     (p=0.159 n=5+4)
ImagePackageCatalogers/apkdb-cataloger-2                      7.37k ± 0%     7.37k ± 0%     ~     (p=0.643 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            14.0 ± 0%      14.0 ± 0%     ~     (all equal)

[wagoodman]

Great work --this is a huge feature 🎉 Can't wait for the keyless work next 🤓