fix: allow cosign download sbom when image is absent

[vishal-chdhry]

Summary

Closes: #2603

Cosign will not fail to download sbom when image is absent.

This PR build on top of changes made in: #2959

Proof:

$ DIGEST=$(crane digest cgr.dev/chainguard/static)

$ crane copy cgr.dev/chainguard/static@$DIGEST ttl.sh/sbom-no-img:1h
2023/09/16 21:37:03 Copying from cgr.dev/chainguard/static@sha256:a432665213f109d5e48111316030eecc5191654cf02a5b66ac6c5d6b310a5511 to ttl.sh/sbom-no-img:1h
...
sha256:a432665213f109d5e48111316030eecc5191654cf02a5b66ac6c5d6b310a5511 size: 1835

$ go run ./cmd/cosign sign ttl.sh/sbom-no-img:1h 
Generating ephemeral keys...
Retrieving signed certificate...
...
Pushing signature to: ttl.sh/sbom-no-img

$ go run ./cmd/cosign attach sbom ttl.sh/sbom-no-img@$DIGEST  --sbom <(echo "{}")
WARNING: Attaching SBOMs this way does not sign them. If you want to sign them, use 'cosign attest --predicate /dev/fd/11 --key <key path>' or 'cosign sign --key <key path> --attachment sbom <image uri>'.
Uploading SBOM file for [ttl.sh/sbom-no-img@sha256:a432665213f109d5e48111316030eecc5191654cf02a5b66ac6c5d6b310a5511] to [ttl.sh/sbom-no-img:sha256-a432665213f109d5e48111316030eecc5191654cf02a5b66ac6c5d6b310a5511.sbom] with mediaType [text/spdx].

$ go run ./cmd/cosign download sbom ttl.sh/sbom-no-img@$DIGEST 

WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>' or verify its signature using 'cosign verify --key <key path> --attachment sbom <image uri>'.
Found SBOM of media type: text/spdx
{}

$ crane delete ttl.sh/sbom-no-img@$DIGEST 

$ crane delete ttl.sh/sbom-no-img@$DIGEST # delete confirmation
Error: DELETE https://ttl.sh/v2/sbom-no-img/manifests/sha256:a432665213f109d5e48111316030eecc5191654cf02a5b66ac6c5d6b310a5511: MANIFEST_UNKNOWN: manifest unknown

$ go run ./cmd/cosign download sbom ttl.sh/sbom-no-img@$DIGEST
WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>' or verify its signature using 'cosign verify --key <key path> --attachment sbom <image uri>'.
Found SBOM of media type: text/spdx
{}

Release Note

Added support for cosign download sbom when image is absent

Documentation

[codecov]

Codecov Report

Merging #3245 (6995070) into main (d5b8c35) will increase coverage by 0.58%.
Report is 44 commits behind head on main.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main    #3245      +/-   ##
==========================================
+ Coverage   30.35%   30.93%   +0.58%     
==========================================
  Files         155      155              
  Lines        9845     9929      +84     
==========================================
+ Hits         2988     3072      +84     
+ Misses       6410     6404       -6     
- Partials      447      453       +6     

see 11 files with indirect coverage changes

[haydentherapper]

Seems good to me, but I'm not familiar with the code path - @imjasonh @hectorj2f can you confirm this LGTY?

[hectorj2f]

LGTM, although we could add comments in the code to explain it.

[vishal-chdhry]

@haydentherapper @hectorj2f Added comments can you please review?