feat(sbom, attest): sign multi-platform SBOMs, verify every platform

[reyreavman]

Summary

Multi-platform builds with --sign-key now publish a signed Sigstore Bundle per platform manifest instead of unsigned SBOMs with a "multi-platform SBOM signing is not yet supported" warning. werf attest verify pointed at a multi-platform index without --platform now verifies the attestations of every platform in one command and succeeds only if all of them are valid, so a release gate can no longer pass while one architecture ships unattested.

What

Build signing

• With --sign-key/--sign-cert set, every platform of a multi-platform image gets its own signed Sigstore Bundle v0.3 attestation, same key and artifact form as single-platform; the "multi-platform SBOM signing is not yet supported" warning is gone.
• A signing failure of any platform fails the build fail-fast with an error naming the image and platform; remaining platform SBOMs of that image are not converged.
• Enabling signing or rotating the key on an existing multi-platform project invalidates the SBOM cache of every platform; signed bundles supersede stale bare-DSSE entries in the fallback index.
• Unchanged rebuild with the same key serves every platform SBOM from the registry cache.
• Unsigned multi-platform builds, single-platform builds (signed and unsigned) and all cache checksums are byte-form unchanged.
• Nothing is ever attached to the index digest; each attestation's in-toto subject is its platform manifest digest.
• VERIFIED: stock cosign v3.0.6 verify-attestation --new-bundle-format --insecure-ignore-tlog --key verifies both platform attestations of a werf-built two-platform image fully offline (cosign is not installed in CI; the same assertion runs in-process there).
• Multi-platform SBOM e2e requires WERF_EXPERIMENTAL_STAPEL_ARM=1 (stapel+Docker backend); the new suite is the first actively running multi-platform SBOM e2e — the 016 suites remain XEntry pending Buildah SBOM support.

attest verify on an index

• An index reference without --platform verifies ALL platforms: prints a PLATFORM/DIGEST/STATUS table and exits non-zero unless every platform is verified (previously this errored with "image is a multi-platform index, platform required").
• Each failing platform is classified: missing (no attestation), unsigned (legacy bare-DSSE, message suggests rebuilding with --sign-key), invalid (wrong key, tampered payload or predicate type mismatch); the aggregate error reads "attestation verification failed for N of M platforms".
• Index entries with unknown/unknown platform (e.g. buildx attestation manifests) are excluded from verification.
• --platform narrows verification to one platform; non-index references and the raw predicate dump to stdout are unchanged.
• attest get and sbom get deliberately keep the strict behavior: an index reference without --platform still fails listing available platforms.
• --platform flag help text and the command's long description are updated; the attest tree stays hidden, so no CLI reference pages change.

Why

SBOM signing (016-sbom-signing) deliberately blocked multi-platform builds behind a single capability predicate because the multi-platform SBOM lied about its platform — signing it would certify a false statement. Per-platform SBOM generation (016-sbom-multiplatform-per-platform) fixed that, leaving the guard as dead weight that silently downgraded signed pipelines to unsigned artifacts. On the verification side, requiring --platform made "verify the image" a per-architecture chore where forgetting one platform produced a false green; verifying all platforms by default matches how the artifacts are now produced — one key, N attestations. An index-level aggregate attestation was rejected: it would reintroduce a platform-ambiguous artifact and nothing may be attached to the index digest.

Spec: specs/018-sbom-multiplatform-signing/.