To provide facts for SBOM creation on vendored builds, we cannot rely on binary scanning. Instead we need to provide a SBOM based on the source package management (e.g. go.mod for go-based, Cargo.toml for rust-based, etc).
This package sbom needs to be available before installation. Thus this issue focusses on the creation and provision of such package sbom which is interlinked in the debian control file.
Reading of this annotated sbom will be done in the builder: gardenlinux/builder#163
To provide facts for SBOM creation on vendored builds, we cannot rely on binary scanning. Instead we need to provide a SBOM based on the source package management (e.g.
go.modfor go-based,Cargo.tomlfor rust-based, etc).This package sbom needs to be available before installation. Thus this issue focusses on the creation and provision of such package sbom which is interlinked in the debian control file.
Reading of this annotated sbom will be done in the builder: gardenlinux/builder#163