fix: replace colons in SBOM filename for Docker image attestation

ThomasK33 · ThomasK33 · commit 8672ae7fc124 · 2025-03-13T18:04:01.000+01:00
Change-Id: I887f4fc255d9bfa19b6c5d23ad0a5db7352aa2af
Signed-off-by: Thomas Kosiewski &lt;tk@coder.com&gt;
diff --git a/scripts/build_docker.sh b/scripts/build_docker.sh
@@ -154,14 +154,14 @@ if [[ "$push" == 1 ]]; then
 fi
 
 log "--- Generating SBOM for Docker image ($image_tag)"
-syft "$image_tag" -o spdx-json >"${image_tag}.spdx.json"
+syft "$image_tag" -o spdx-json >"${image_tag//:/_}.spdx.json"
 
 if [[ "$push" == 1 ]]; then
 	log "--- Attesting SBOM to Docker image for $arch ($image_tag)"
 	COSIGN_EXPERIMENTAL=1 cosign clean "$image_tag"
 
 	COSIGN_EXPERIMENTAL=1 cosign attest --type spdxjson \
-		--predicate "${image_tag}.spdx.json" \
+		--predicate "${image_tag//:/_}.spdx.json" \
 		--yes \
 		"$image_tag"
 fi
