Add ability to specify a custom SBOM generator

[LaurentGoderre]

No description provided.

[whalelines]

Test?

[LaurentGoderre]

@whalelines yep. I have to figure out how to test this.

[yosifkit]

bashbrew/cmd/bashbrew/docker.go

Lines 299 to 300 in 10343d3

	sbomGeneratorEnv = "BASHBREW_BUILDKIT_SBOM_GENERATOR"
	buildxBuilderEnv = "BUILDX_BUILDER"

A little confused by the need for this change. Currently, the SBOM generator is set via BASHBREW_BUILDKIT_SBOM_GENERATOR in the environment, so an export BASHBREW_BUILDKIT_SBOM_GENERATOR=... should be enough to change it to something custom for local build tests (along with a BUILDX_BUILDER name).

I'm not sure I see why we'd need a different SBOM generator per tag of an image (or even per image repo). I'd be very hesitant to add new fields to the library files (the Manifest2822Entry) without a large need in Docker Official Images.

[LaurentGoderre]

@yosifkit this allows specifying an alternate one for an image. In this case: clearlinux

[LaurentGoderre]

@yosifkit example of an SBOM created buy another tool: https://explore.ggcr.dev/?blob=laurentgoderre689/clearlinux@sha256:bdb988504c07acf67d1b35c44fd2a982430ebf5984d3827596b9a7d2a70593b2&mt=application%2Fvnd.in-toto%2Bjson&size=14958

[tianon]

I don't think we currently have any other images that are FROM clearlinux, but if we did, wouldn't they then need both this clearlinux-custom SBOM generation method and the normal one so that we pick up any non-package-provided binaries correctly too? (from that perspective, IMO it makes more sense to either improve the existing SBOM scanner or convince clearlinux to embed the result in their images and suggest anyone FROM clearlinux also run this tool and embed the result, but all that still feels like we're missing something in the main SBOM scanner, especially if clearlinux becomes popular enough to warrant the level of effort)

[whalelines]

Is this still relevant/needed?

[LaurentGoderre]

I still think it is