fix: workflow binary path, digest format; pipeline exports CA cert in attest-only mode

Author: sns45

.github/workflows/assayward-gate.yml

@@ -25,7 +25,7 @@ jobs:
 
       - name: Self-attest with forgeseal pipeline
         run: |
-          ./forgeseal pipeline \
+          ./bin/forgeseal pipeline \
             --dir . \
             --output-dir ./forgeseal-output \
             --sign \
@@ -35,7 +35,7 @@ jobs:
       - name: Compute artifact digest
         id: digest
         run: |
-          DIGEST=$(sha256sum ./forgeseal 2>/dev/null || sha256sum ./bin/forgeseal 2>/dev/null || echo "sha256:unknown")
+          DIGEST="sha256:$(sha256sum ./bin/forgeseal 2>/dev/null | awk '{print $1}' || echo 'unknown')"
           echo "value=$DIGEST" >> "$GITHUB_OUTPUT"
 
       - name: Obtain svidmint SVID

internal/cli/pipeline.go

@@ -131,6 +131,7 @@ func runPipeline(cmd *cobra.Command, args []string) error {
 	}
 
 	// Step 2: Sign SBOM
+	caExported := false
 	if doSign {
 		if !quiet {
 			fmt.Fprintln(os.Stderr, "Step 2/4: Signing SBOM...")
@@ -153,6 +154,7 @@ func runPipeline(cmd *cobra.Command, args []string) error {
 				if err := keyedSigner.ExportCATo(outputDir); err != nil {
 					return fmt.Errorf("exporting CA cert: %w", err)
 				}
+				caExported = true
 				if !quiet {
 					fmt.Fprintf(os.Stderr, "  CA cert exported to %s/forgeseal-signing-ca.crt\n", outputDir)
 				}
@@ -202,6 +204,16 @@ func runPipeline(cmd *cobra.Command, args []string) error {
 					if err := signing.WriteBundle(signResult.Bundle, bundlePath); err != nil {
 						return fmt.Errorf("writing attestation signature: %w", err)
 					}
+					// Export CA cert here if it wasn't already exported during SBOM signing
+					// (e.g. if SBOM signing was skipped or failed before ExportCATo was reached)
+					if keyed && !caExported {
+						if err := keyedSigner.ExportCATo(outputDir); err != nil {
+							return fmt.Errorf("exporting CA cert: %w", err)
+						}
+						if !quiet {
+							fmt.Fprintf(os.Stderr, "  CA cert exported to %s/forgeseal-signing-ca.crt\n", outputDir)
+						}
+					}
 				}
 			}
 		}