Attestation "predicate invalid" for an in-toto statement in CI

By Daniel Zoghalchali·Latchkey

An in-toto attestation pairs a predicate type with a predicate body. "predicate invalid" means the JSON you attached does not conform to the schema that type declares, so verifiers cannot interpret it.

What this error means

cosign attest, a policy engine, or a verifier rejects the attestation with "predicate invalid", "predicate does not match type", or a JSON schema validation error.

Error: invalid predicate: predicate type https://cyclonedx.org/bom does not match
predicate body (missing bomFormat/specVersion)

Common causes

The predicate body does not match its type

You declared a CycloneDX or SLSA provenance type but attached a body that lacks the required fields, so schema validation fails.

A malformed or truncated predicate file

Invalid JSON, a partial write, or the wrong file passed as the predicate makes it unparseable.

How to fix it

Match the predicate file to the declared type

1. Confirm the predicate JSON has the fields its type requires.
2. Set --type to the value that matches the body (cyclonedx, spdx, slsaprovenance, or a URI).
3. Validate the JSON parses before attesting.

jq empty sbom.cdx.json   # fails if the JSON is malformed
cosign attest --predicate sbom.cdx.json --type cyclonedx ghcr.io/acme/app@sha256:...

Regenerate the predicate with a real generator

Produce the predicate with a tool that emits the correct schema (syft for SBOMs, a SLSA generator for provenance) rather than hand-editing it.

How to prevent it

• Generate predicates with tools that emit the correct schema.
• Keep --type consistent with the predicate body.
• Validate predicate JSON in CI before attesting.

Frequently asked questions

Related guides

References

• GitHub Actions documentation