🐛 Right now `--sbom-dir` with a multi-arch build just writes the same file over and over.
This loosely follows the lead of apko which uses the form `sbom-{arch}.{form}.json`, but we are going with: `{app}-{platform}.{form}.json`.
It is notable that `{platform}` is a superset of `{arch}` and we sanitize the string encoding replacing the `/` and `:` characters with `-`.
/kind bug
* Have `--image-refs` list all images for multi-arch builds.
This change alters the behavior of `--image-refs` to also include all of the image references when a multi-architecture build is being performed.
* Add test coverage for the new path
* Add ref count check to unit test
* Decorate per-architecture images with base image annotations.
Currently we only decorate the topmost index/image with base image data for the base index/image (for everything except docker manifest lists).
This change makes multi-arch builds decorate the manifest of the per-architecture images with the reference of the base index, and the digest of the specific base image used for that particular architecture's image.
This results in the per-architecture SBOMs starting to encode `DESCENDENT_OF` links as well.
* Add a detailed comment outlining why the per-arch digest is preferable even for cases where we want to watch the base index for updates.
1. Change index -> image relationship type from `CONTAINS` to `VARIANT_OF` (I think this was an oversight in my original PR),
2. Always include `mediaType` in pURLs for index/images we produce (I'm not adding this to the base image, since it's not readily available, but we can add it there if we want to find a way to plumb it through),
3. Include more platform discriminator information to the pURLs we use in index -> image.
This plumbs through support for building multi-arch SPDX SBOMs largely based on Puerco's outline, but with a few
adaptations. I added a few minor refactorings to try to enable consistency across the Image/Index SBOMs.
Related: https://github.com/google/ko/issues/655
* Unconditionally set the base image annotation.
Previously we only set this annotation when our base image was a tag, but this means when folks actually follow the best practice of use digest base images they get strictly worse resulting images!
It sounds like maybe the original motivation for this condition was that it was supposed to contain the mutable reference (tag), but I don't see anything detailing such a restriction (just an example), so there should be nothing
precluding this from the spec.
* Fold assignment into map initialization.
Matt Moore