Attestations docs

[jedevc]

This PR adds two pieces of documentation:

• A user-facing guide to how to enable and use attestations (to likely be later migrated to the buildx repository, once we implement an appropriate user-facing syntax). For now this includes SBOM documentation, but we can later expand this to also include SLSA provenance info (Support for provenance attestations #3240).
• A developer-facing guide for how the SBOM scanning protocol works, which should be useful for anyone building custom integrations down the road.

[tonistiigi]

We could show a snippet of how the SPDX content actually looks like.

How to add custom packages to SBOM using the nested SBOM technique.

How to read the layer info from the SPDX record.

[jedevc]

1. Added an SPDX snippet ✔️
2. This is scanner-specific behaviour - we should document this in the scanner itself, since a scanner may not include this information. Also, this behaviour isn't fully implemented in syft, and is partially blocked on SBOM cataloger anchore/syft#1029. ✖️
3. Added info on the layer data ✔️

[jedevc]

CC @wagoodman @kzantow 🎉

[tonistiigi]

Does the default scanner support the nested files now that the PR looks to be merged?

I think this should be documented in the regular sbom docs like the Dockerfile ARGs. This is something that we expect the users to know and modify their Dockerfiles to get better sboms. We can mention that this works in default scanner and if user uses custom scanner then it is up to that implementation to decide if it is supported.

[jedevc]

Ahh, so yes syft has merged it, but it's not made into a release.

I think we should aim to follow syft releases for buildkit-syft-scanner, instead of building off of master?

[crazy-max]

We already vendor a syft release right? https://github.com/docker/buildkit-syft-scanner/blob/6a7324fe9deac77f3a6f22770b7a8a09b4ce1723/go.mod#L8

[tonistiigi]

Follow-up: could we use some labels to track what is supported so we have a upgrade path?

[jedevc]

I assume you mean in the image labels? Yup, I'll do a follow-up 😄

[jedevc]

Added do-not-merge label - this PR documents functionality that is added in:

• Supplement generated SBOMs with layer information post-build #3258
• BUILDKIT_SBOM_SCAN build args #3249

Additionally, we need to move jedevc/buildkit-syft-scanner to another location 😄

[crazy-max]

LGTM