feat: native SBOM support (SBoM/v1 input, sbom linking, orchestrating SBOM)

[a-thaler]

What

Adds native SBOM support to OCM: attach SBOMs to component resources, discover them from OCI images at build time, and assemble an orchestrating SBOM for a whole component version.
This PR is an outcome from a hackathon and outlines a potential solution for open-component-model/ocm-project#1225

Why

A component is only as trustworthy as your ability to say what is inside it. This makes SBOMs first-class OCM resources — transported with the component, accessed uniformly whether the component lives in a CTF archive or an OCI registry, and aggregatable into one document a scanner (Trivy, Dependency-Track, …) can consume.

Design background: docs/adr/0026_native_sbom_support.md.

What's included

• Label-linked SBOMs — a resource of type: sbom linked to its subject via the ocm.software/artefactReference label, whose value is a flat identitySelector (name/version of the described resource). Follows the ocm-spec artefact-reference convention. Discovery: descriptor.FindSBOMResources.
• SBoM/v1 input type (bindings/go/input/sbom) — discovers the SBOM attached to a referenced resource's OCI image (buildx attestation + OCI Referrers API, in-toto unwrapped) at construction time and bakes it as a local blob in its original format (e.g. SPDX). References the subject by {name, version, extraIdentity}; resolved to the subject's access by a pre-construction pass (no constructor-core change). For a multi-arch image it attaches every platform's SBOM (one resource per platform, arch-tagged via the resource's own extraIdentity), or a single platform when the reference sets extraIdentity.architecture. The auto-added label carries name/version only (no architecture), so it stays a subset of the subject image's identity; per-arch disambiguation is via the SBOM resource's extraIdentity.
• On-image discovery in the OCI binding (bindings/go/oci) — FetchImageSBOMs, ListImagePlatforms, ImageSBOMDownloader/ImagePlatformLister, per-platform resolution. Only SBOM predicates (SPDX/CycloneDX) are extracted; SLSA provenance layers are intentionally ignored.
• ocm get sbom <cv> [--recursive] — assembles a single flat CycloneDX 1.6 document (hierarchy in the dependencies graph, so scanners actually read it); SPDX/CycloneDX-XML normalized to CycloneDX; -o json|yaml; host-arch selection for per-arch SBOMs.
• Downloading a single SBOM needs no special flag — it is a named resource: ocm download resource --identity name=<sbom-resource>.
• Docs: ADR 0026, SBoM/v1 reference entry, and an end-to-end tutorial.

Verification

• Unit tests across bindings/go/sbom, bindings/go/input/sbom, and the CLI pre-pass / get sbom.
• End-to-end against ghcr.io/stefanprodan/podinfo:6.9.1: add cv bakes per-arch SPDX SBOMs, each carrying the ocm.software/artefactReference label; get sbom --recursive produces a flat CycloneDX doc that Trivy scans successfully.

Notes

• New binding modules (bindings/go/sbom, bindings/go/input/sbom) isolate the CycloneDX/protobom dependencies; go.sum should be re-verified against the sumdb in CI.
• The SBoM/v1 input reads the image index at add cv time to enumerate platforms (needs registry credentials).
• The ocm.software/artefactReference label follows the still-in-review ocm-spec convention (docs(conventions): define artefact-linking label convention ocm-spec#146); the value shape may change if that lands differently.

[netlify]

✅ Deploy Preview for ocm-website ready!

Name	Link
🔨 Latest commit	d06e7ef
🔍 Latest deploy log	https://app.netlify.com/projects/ocm-website/deploys/6a686a44cf232c0008c439db
😎 Deploy Preview	https://deploy-preview-3177--ocm-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8b3f68b0-a8a2-4d46-96cb-c007a83ed8fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}