discover sbom in OCI registry

[itaysk]

when scanning a container image, trivy should check if there's an associated SBOM in the registry, and if so, use it instead of analyzing the image, similar to how trivy image --sbom-source rekor works. This should be possible with the new OCI Reference types specs.
opencontainers/image-spec#934

[caozhuozi]

What would happen if multiple SBOM are attached? Which one will be used?

According to the implementation #3768, is the first one returned by the referres API will be used?

[caozhuozi]

Typically, an image's sbom will be expired in terms of vulnerabilities. So there will be situations where we regularly attach the SBOM for images.

If so, It is more reasonable to use the latest one by default?

[itaysk]

thanks for the suggestion. If I recall correctly, we did discuss this already when building the feature and the challange was that there's no native creation date field in the artifact spec, only an annotation that CAN be added by the artifact submitter. Trivy's referrer plugin does populate this annotation, and therefore supports sorting artifacts by creation date. If you have a good suggestion for how to handle this or want to discuss this further, please open a new feature enhancement discussion.

[caozhuozi]

@itaysk Thank you for providing the detailed background to this question! 💗