chore(ci): generate sigstore bundles instead of signatures and certs

[scop]

Description

Separate signatures and certificates are deprecated as of cosign 3.1.1,
refs https://github.com/sigstore/cosign/releases/tag/v3.1.1, https://github.com/sigstore/cosign/releases/tag/v3.1.2

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
• Documentation (updates the documentation)
• Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
• Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

[wagoodman]

This needs more careful review on the impact of the install.sh verify feature also. I'll dig into this and report back what I find.

[Stetsed]

This needs more careful review on the impact of the install.sh verify feature also. I'll dig into this and report back what I find.

Hey! I just wanted to pop in here as I only recently saw this issue while scrolling through, and actually touches upon what I commented in #585 (comment)

This will indeed require changes for the install script, the bigger problem I suspect that due to immutable releases you will actually need to check what version it has, and if it’s a version that is post whenever this would be merged, to verify via bundle instead. Assuming that the intent would ofcourse be to actually deprecate the deprecated method.

Because otherwise let’s say somebody tries to download vX.Y.Z which is before this, it would break because the install script in most cases(including sbom-action) is pulled from main(which has its own issues with interior mutability but I digress that’s for that repo).

So what would be needed:

1. Have a dedicated verifier function for new and the old system, which references the version of Syft being downloaded, or checks what files are available depending on how it’s implemented.
2. Generate the signatures in the new format which is implemented in this PR

For the first, this is contained inside of lines 644-656, as not only the command for checking (verify-sign, 592-615) need to be changed, but also what files it would attempt to download would need to be changed. If it would help out I can see if I can have a POC as I’ve been working on areas similar to this attempting to implement my own syft-download action(Due to my dislike of interior mutability in the public aftion).

Overall this would require a definitive design decision on how/if to handle the backwards compatibility. Currently as can be seen in the code it checks the version, aborting the install if attempting to install a version that doesn’t have co-sign signatures available. So I suppose expanding on this could be adding a vb or similar option, but that becomes a design choice.

Abort if version less then Y, before which no co-sign signatures where given
Allow if version between Y and X, where the now deprecated format was provided
Abort if version above X, where the new bundle format was provided

OR

Abort if version less than Y
Allow if version between Y and X, using the old format
Allow if version above X, and co-sign version above Z where bundle format is supported, using the new bundles

I do apologize if this is the wrong place to place such information, I do not often interact in this sort of way, and hope the above can be atleast somewhat helpful from my time looking into this stuff recently.