install.sh: check checksums file's signature about syft HOT 2 CLOSED

Hi @martinetd, thanks for the report! The .pem and .sig files come from a step in our build process that uses cosign to sign the checksum files of the binaries: https://github.com/anchore/syft/blob/main/.goreleaser.yaml#L263-L274

Here is one way you can verify the signatures using the cosign command:

cosign verify-blob {checksums_filepath} \
  --certificate {checksums_cert_file_path} \
  --signature {checksum_sig_file_path} \
  --certificate-identity-regexp "https://github/\.com/${OWNER}/${REPO}/\.github/workflows/.+" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com/"

There is also a PR against Grype to do this in the install.sh script, and it could probably be finished and ported over to Syft: anchore/grype#1670

Hopefully this helps!

from syft.

Thanks, I was able to verify locally.

I've commented on grype's PR and agree once it's ready it'll be easy to update syft as well, let's continue over there :)

from syft.