add sbom field to buildpack.toml (Buildpack API 0.7)

[robdimsdale]

Signed-off-by: Rob Dimsdale-Zucker rdimsdale@vmware.com

Summary

As part of implementing the RFC for Syft/CycloneDX we need to add a field to the buildpack.toml as described in the upstream RFC.

Use Cases

Checklist

• I have viewed, signed, and submitted the Contributor License Agreement.
• I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
• I have added an integration test, if necessary.
• I have reviewed the styleguide for guidance on my code quality.
• I'm happy with the commit history on this PR (I have rebased/squashed as needed).

[fg-j]

@paketo-buildpacks/tooling-maintainers As you can see, there were 2 representations of the buildpack.toml that needed to change. I don't love that we have two structs inside of packit representing ostensibly the same thing. Can anyone shed light on why we have two? I know that some of the things in cargo aren't spec'd (e.g. dependency constraints); but I'm wondering if we can de-duplicate the representation of fields like buildpack.licenses and buildpack.sbom.

[fg-j]

Per this update in the CNB slack the field will need to be renamed.

[robdimsdale]

Per this update in the CNB slack the field will need to be renamed.

Done.

[sophiewigmore]

We were holding back on the release of this PR until buildpack API 0.7 became available. It is available now, so I think we can merge this in unless @ForestEckhardt or @ryanmoran have any other concerns.

[fg-j]

@paketo-buildpacks/tooling-maintainers – minor version bump?

[ForestEckhardt]

@paketo-buildpacks/tooling-maintainers – minor version bump?

I don't have strong opinions minor sounds right to me