remove previously deprecated attach/download sbom commands

cmd/cosign/cli/attach.go

@@ -16,9 +16,6 @@
 package cli
 
 import (
-	"fmt"
-	"os"
-
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/attach"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/spf13/cobra"
@@ -32,7 +29,6 @@ func Attach() *cobra.Command {
 
 	cmd.AddCommand(
 		attachSignature(),
-		attachSBOM(),
 		attachAttestation(),
 	)
 
@@ -75,32 +71,6 @@ func attachSignature() *cobra.Command {
 	return cmd
 }
 
-func attachSBOM() *cobra.Command {
-	o := &options.AttachSBOMOptions{}
-
-	cmd := &cobra.Command{
-		Use:              "sbom",
-		Short:            "DEPRECATED: Attach sbom to the supplied container image",
-		Long:             "Attach sbom to the supplied container image\n\n" + options.SBOMAttachmentDeprecation,
-		Example:          "  cosign attach sbom <image uri>",
-		Args:             cobra.ExactArgs(1),
-		PersistentPreRun: options.BindViper,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			fmt.Fprintln(os.Stderr, options.SBOMAttachmentDeprecation)
-			mediaType, err := o.MediaType()
-			if err != nil {
-				return err
-			}
-			fmt.Fprintf(os.Stderr, "WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate %s --key <key path>'.\n", o.SBOM)
-			return attach.SBOMCmd(cmd.Context(), o.Registry, o.RegistryExperimental, o.SBOM, mediaType, args[0])
-		},
-	}
-
-	o.AddFlags(cmd)
-
-	return cmd
-}
-
 func attachAttestation() *cobra.Command {
 	o := &options.AttachAttestationOptions{}
 

cmd/cosign/cli/download.go

@@ -16,9 +16,6 @@
 package cli
 
 import (
-	"fmt"
-	"os"
-
 	"github.com/spf13/cobra"
 
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/download"
@@ -33,7 +30,6 @@ func Download() *cobra.Command {
 
 	cmd.AddCommand(
 		downloadSignature(),
-		downloadSBOM(),
 		downloadAttestation(),
 	)
 
@@ -59,31 +55,6 @@ func downloadSignature() *cobra.Command {
 	return cmd
 }
 
-func downloadSBOM() *cobra.Command {
-	o := &options.RegistryOptions{}
-	do := &options.SBOMDownloadOptions{}
-
-	cmd := &cobra.Command{
-		Use:              "sbom",
-		Short:            "DEPRECATED: Download SBOMs from the supplied container image",
-		Long:             "Download SBOMs from the supplied container image\n\n" + options.SBOMAttachmentDeprecation,
-		Example:          "  cosign download sbom <image uri>",
-		Args:             cobra.ExactArgs(1),
-		PersistentPreRun: options.BindViper,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			fmt.Fprintln(os.Stderr, options.SBOMAttachmentDeprecation)
-			fmt.Fprintln(os.Stderr, "WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>'.")
-			_, err := download.SBOMCmd(cmd.Context(), *o, *do, args[0], cmd.OutOrStdout())
-			return err
-		},
-	}
-
-	do.AddFlags(cmd)
-	o.AddFlags(cmd)
-
-	return cmd
-}
-
 func downloadAttestation() *cobra.Command {
 	o := &options.RegistryOptions{}
 	ao := &options.AttestationDownloadOptions{}