Generate sbom at build?

[carolynvs]

I just saw that buildkit now supports generating an SBOM (software bill of materials) and provenance information. https://github.com/moby/buildkit/releases/tag/v0.11.0-rc1

Since Porter uses buildkit when creating the bundle invocation image, is this something that we are interested in generating and publishing in or with the bundle?

If anyone is interested in digging into SBOMs, and coming up with a design, we are looking for volunteers!

[MChorfa]

I would be interested to work on this.

[carolynvs]

Great! If anyone else would like to work on this too, let us know. 👍

I'm not terribly familiar with SBOMs so as we work on this, if we can provide background information on what info a SBOM provides, and how we anticipate people will use it, that will help shape the design and give everyone a proper shared context for collaboration.

@MChorfa Please let me know how I can help! While I don't have time to work directly on an implementation, I can layout next steps, review and ask questions on any proposed designs or help organize meetings on zoom if that would help.