Sign the generated BOMs

Signed-off-by: Prabhu Subramanian <[email protected]>

Author: prabhu

.github/workflows/image-build.yml

@@ -89,6 +89,7 @@ jobs:
       - name: save private key to file
         run: |
           echo $SBOM_SIGN_PRIVATE_KEY_DATA > $GITHUB_WORKSPACE/private.key
+          ls -lh $GITHUB_WORKSPACE/private.key
         env:
           SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
       - name: Attach cdx sbom to base
@@ -101,7 +102,7 @@ jobs:
         continue-on-error: true
         if: github.ref == 'refs/heads/master'
         env:
-          SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+          SBOM_SIGN_ALGORITHM: RS512
           SBOM_SIGN_PRIVATE_KEY: ${{ github.workspace }}/private.key
       - name: Attach cdx sbom
         run: |
@@ -113,5 +114,5 @@ jobs:
         continue-on-error: true
         if: ${{ startsWith(github.ref, 'refs/tags/') && ! fromJSON(inputs.image).cdxgen-image.skip-tags }}
         env:
-          SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+          SBOM_SIGN_ALGORITHM: RS512
           SBOM_SIGN_PRIVATE_KEY: ${{ github.workspace }}/private.key

.github/workflows/npm-release.yml

@@ -139,7 +139,7 @@ jobs:
       continue-on-error: true
       if: startsWith(github.ref, 'refs/tags/')
       env:
-        SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+        SBOM_SIGN_ALGORITHM: RS512
         SBOM_SIGN_PRIVATE_KEY: ${{ github.workspace }}/private.key
     - name: Attach cdx sbom to release
       uses: softprops/action-gh-release@v2
@@ -198,7 +198,7 @@ jobs:
         continue-on-error: true
         if: startsWith(github.ref, 'refs/tags/')
         env:
-          SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+          SBOM_SIGN_ALGORITHM: RS512
           SBOM_SIGN_PRIVATE_KEY: ${{ github.workspace }}/private.key
       - name: Attach cdx secure sbom to release
         uses: softprops/action-gh-release@v2
@@ -268,7 +268,7 @@ jobs:
       continue-on-error: true
       if: startsWith(github.ref, 'refs/tags/')
       env:
-        SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+        SBOM_SIGN_ALGORITHM: RS512
         SBOM_SIGN_PRIVATE_KEY: ${{ github.workspace }}/private.key
     - name: Attach cdx deno sbom to release
       uses: softprops/action-gh-release@v2
@@ -384,7 +384,7 @@ jobs:
       continue-on-error: true
       if: startsWith(github.ref, 'refs/tags/')
       env:
-        SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+        SBOM_SIGN_ALGORITHM: RS512
         SBOM_SIGN_PRIVATE_KEY: ${{ github.workspace }}/private.key
     - name: Attach cdx bun sbom to release
       uses: softprops/action-gh-release@v2