attestation

SBOM Signing in CI: How to Sign and Attest With Cosign

One CI shape: build an image by digest, Syft SBOM, Cosign sign + SBOM attest, verify success, and prove wrong-key/unsigned failure — the operational follow-on to after-xz.