rewanthtammana / sigstore-the-easy-way Goto Github PK

Here , under the Extract artifact from the registry section:
the command cosign verify-attestation --key cosign.pub $IMAGE | jq -r .payload | base64 -D | jq . is incorrect.

On running it, return an error: base64: invalid option -- 'D'
Instead it should be -d in place of -D.
Therefore the whole correct command would be:
cosign verify-attestation --key cosign.pub $IMAGE | jq -r .payload | base64 -d | jq .

There is a missing sbom within the cosign/attach-artifacts document.

Currently:

cosign attach --sbom image.sbom $IMAGE

Should be:

cosign attach sbom --sbom image.sbom $IMAGE

Thank you for creating this workshop 🙌

Here, under the section of Verify the artifact , the command cosign verify $IMAGE throws an error:

cosign verify $IMAGE                                                                                                      1 ↵ ──(Wed,Jul26)─┘

Error: --certificate-identity or --certificate-identity-regexp is required for verification in keyless mode
main.go:74: error during command execution: --certificate-identity or --certificate-identity-regexp is required for verification in keyless mode

Actual behaviour: throw an error.
Desired Behaviour: shouldn't throw an error. Or there would be some changes in the upstream project which requires values --certificate-identity along with the cosign verify command.