Update sign.yaml

container/sign.yaml

@@ -38,7 +38,7 @@ include:
         cosign attest -y --key  hashivault://cosign --predicate /tmp/image.sbom --type=vuln ${digest}
         trivy image -f cyclonedx -o sbom.cdx.json ${digest}
         cosign attest -y --key  hashivault://cosign --type cyclonedx --predicate sbom.cdx.json ${digest}
-        trivy image -f spdx-json -o sbom.spdx.json ${digest}
-        cosign attest -y --key  hashivault://cosign --type spdxjson --predicate sbom.spdx.json ${digest}
+        #trivy image -f spdx-json -o sbom.spdx.json ${digest}
+        #cosign attest -y --key  hashivault://cosign --type spdxjson --predicate sbom.spdx.json ${digest}
       done