ClustertImagePolicy requiring an SBOM in SPDX format stored as a keyless attestation against public Fulcio using cosign

policy-spdxjson.yaml

apiVersion: policy.sigstore.dev/v1alpha1
kind: ClusterImagePolicy
metadata:
  name: keyless-attestation-spdxjson
spec:
  images:
  - glob: **
  authorities:
  - name: keyless
    keyless:
      url: "https://fulcio.sigstore.dev"
    attestations:
    - name: must-have-spdxjson
      predicateType: spdxjson
      policy:
        type: cue
        data: |
          predicateType: "cosign.sigstore.dev/attestation/v1"