Merge pull request #120 from vlesich-sylabs/sbom_fix

fix: Syft verbose mode, cosign key

Author: vlesich-sylabs

.circleci/config.yml

@@ -119,14 +119,14 @@ jobs:
             dpkg -i cosign_1.8.0_amd64.deb
       - run:
           name: Get Cosign Key
-          command: echo $COSIGN_KEY > cosign.key
+          command: echo $COSIGN_KEY | base64 -d > cosign.key
       - run:
           name: Attach attestations to image
           command: |
             for ARCH in amd64 arm64v8
             do
               IMAGE="sylabsio/scs-build:${CIRCLE_TAG}-${ARCH}"
-              syft attest --key ./cosign.key -o cyclonedx-json "${IMAGE}" > sbom.att.json
+              syft attest -v --key ./cosign.key -o cyclonedx-json "${IMAGE}" > sbom.att.json
               cosign attach attestation --attestation sbom.att.json "${IMAGE}"
             done