Skip storing image for downloading attestations

[Falco20019]

Right now, when I execute docker scout attestation get --platform linux/amd64 --predicate --predicate-type https://cyclonedx.org/bom/v1.6 <image> it's downloading the whole image with a couple GB, showing Storing image for indexing for some time. When doing docker pull <image> first, that works a lot more reliable, but has the same downside.

Getting the attestation should be quick and easy just using the manifest. No need to do any indexing, right? Using oras I can quickly grab the manifests and the SBOM within seconds, but would need to extract the in-toto statement myself (or at least I didn't find a nicer way like --predicate --predicate-type https://cyclonedx.org/bom/v1.6 on docker-scout).

[Falco20019]

As workaround, I now use the following shell script:

get_attestation() {
  local image="$1"
  local predicate_type="$2"

  attestations=$(oras manifest fetch "$image" | jq -r '.manifests[]? | select(.annotations["vnd.docker.reference.type"] == "attestation-manifest") | .digest')
  for manifest in $attestations; do
    local blob=$(oras manifest fetch "$image@$manifest" | jq -r --arg pt "$predicate_type" '.layers[] | select(.annotations["in-toto.io/predicate-type"] == $pt) | .digest')

    if [ -n "$blob" ]; then
      oras blob fetch "$image@$blob" -o - | jq '.predicate'
      return 0
    fi
  done

  return 1
}