Releasing SBOM information for images and preparation for vulnerability scanning

[mwindower]

For vulnerability scanning it's valuable to have a full SBOM of metal-stack images, containing all dependencies, at hand.
This could be accomplished e.g. with syft:

syft quay.io/metalstack/debian:12 -o cyclonedx-json > sbom.json

This can be published as GitHub release artifact.
After that, a scanner may use that information to gather vulnerabilities already during build time but potentially also later.

trivy sbom sbom.json --severity <SEVERITY_FILTER>

Risk acceptance can also be documented with a .trivyignore.yaml config:

vulnerabilities:
  - id: CVE-2023-41361
    statement: Accept the risk because we have FRR version >9 installed - s. https://frrouting.org/security