2026 October Release

ProcessPermanent link for this heading

The process consists of three steps:

  • Verify the image’s signature
    Checks whether the image is correctly signed.
  • Download the SBOM attestation
    The cosign attestation is retrieved from the registry and saved locally.
  • Decode the SBOM
    The JSON content (Base64-encoded) is decoded and converted into a readable format.

Verify the Image’s SignaturePermanent link for this heading

The image’s signature can be verified with the following command.

Command

cosign verify \
  --private-infrastructure \
  --key OCI-COSIGN-KEY-Fabasoft-RD-2023 \
  --signature-digest-algorithm=sha512 \
  --registry-username "<user name>" \
  --registry-password "<password>" \
  <registry URL>/<product name>/<image name>@<image digest>

Example

cosign verify \
  --private-infrastructure \
  --key OCI-COSIGN-KEY-Fabasoft-RD-2023 \
  --signature-digest-algorithm=sha512 \
  --registry-username "test-user" \
  --registry-password "*****" \
  registry.fabasoft.com/fabasoft/appducx-lsp@sha256:0664...128e

Download the SBOM AttestationPermanent link for this heading

The SBOM attestation can be downloaded with the following command.

Command

cosign verify-attestation \
  --type cyclonedx \
  --private-infrastructure \
  --key OCI-COSIGN-KEY-Fabasoft-RD-2023 \
  --signature-digest-algorithm=sha512 \
  --registry-username "<user name>" \
  --registry-password "<password>" \
  <registry URL>/<product name>/<image name>@<image digest> \
  > sbom_attestation.json

Example

cosign verify-attestation \
  --type cyclonedx \
  --private-infrastructure \
  --key OCI-COSIGN-KEY-Fabasoft-RD-2023.pub \
  --signature-digest-algorithm=sha512 \
  --registry-username "test-user" \
  --registry-password "*****" \
  registry.fabasoft.com/fabasoft/appducx-lsp@sha256:0664...128e \
  > sbom_attestation.json

Decode the SBOMPermanent link for this heading

The SBOM can be decoded with the following command.

Command

jq -r '.payload' sbom_attestation.json | base64 -d | jq . > sbom-decoded.json

Example

jq -r '.payload' sbom_attestation.json | base64 -d | jq . > sbom_decoded.json

cat sbom_decoded.json

The result is a complete CycloneDX BOM in JSON format. The file can be opened in a text editor or imported into a common SBOM viewer or vulnerability scanner (e.g., Snyk, Grype, Trivy).

Download PDF

Download PDF