Create an SBOM when publishing

[dgannon991]

What does this change

Adds a flag onto the publish command which will generate an SBOM for the published image.

What issue does it fix

Closes #2930

Notes for the reviewer

This is currently an extreme draft version to get feedback, none of the following have been done :D

Checklist

• Did you write tests?
• Did you write documentation?
• Did you change porter.yaml or a storage document record? Update the corresponding schema file.
• If this is your first pull request, please add your name to the bottom of our Contributors list. Thank you for making Porter better! 🙇‍♀️

[kichristensen]

@dgannon991 Do you have a sample of how the SBOM file will look?

[dgannon991]

@kichristensen - this is the output for the porter-test bundle:

{
    "spdxVersion": "SPDX-2.3",
    "dataLicense": "CC0-1.0",
    "SPDXID": "SPDXRef-DOCUMENT",
    "name": "localhost:5000/porter-hello",
    "documentNamespace": "https://anchore.com/Porter/image/localhost-5000/porter-hello-c33f9e71-51f5-4afa-bab5-26c751faa5b6",
    "creationInfo": {
        "licenseListVersion": "3.27",
        "creators": [
            "Organization: Anchore, Inc",
            "Tool: Porter-"
        ],
        "created": "2025-10-07T20:43:18Z"
    },
    "packages": [
        {
            "name": "localhost:5000/porter-hello",
            "SPDXID": "SPDXRef-DocumentRoot-Image-localhost-5000-porter-hello",
            "versionInfo": "v0.1.0",
            "supplier": "NOASSERTION",
            "downloadLocation": "NOASSERTION",
            "filesAnalyzed": false,
            "checksums": [
                {
                    "algorithm": "SHA256",
                    "checksumValue": "ed53c608e21e4d441eb1697a725065446018d90b3b1c6a47873f8ad12a86f671"
                }
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "NOASSERTION",
            "copyrightText": "NOASSERTION",
            "externalRefs": [
                {
                    "referenceCategory": "PACKAGE-MANAGER",
                    "referenceType": "purl",
                    "referenceLocator": "pkg:oci/localhost%3A5000%2Fporter-hello@sha256%3Aed53c608e21e4d441eb1697a725065446018d90b3b1c6a47873f8ad12a86f671?arch=&tag=v0.1.0"
                }
            ],
            "primaryPackagePurpose": "CONTAINER"
        }
    ],
    "relationships": [
        {
            "spdxElementId": "SPDXRef-DOCUMENT",
            "relatedSpdxElement": "SPDXRef-DocumentRoot-Image-localhost-5000-porter-hello",
            "relationshipType": "DESCRIBES"
        }
    ]
}

[kichristensen]

@dgannon991 Does the SBOM also handled other images part of the bundle, in the images section? If not I think it is fine, but we should create a follow up issue for this feature.

[kichristensen]

How big an impact does this feature have on the size the porter binary? A lot of new dependencies have been pulled in.

[kichristensen]

Can this be moved into sbom.go instead? The module has an init function which will be triggered on import

[kichristensen]

Do you want this error to be returned from the function? If so have you tested that, I don't think this is the error that will be returned. I'm pretty sure the deferred function is ran after the return value have been created, meaning this isn't the error that will be returned. Not a 100% sure

[kichristensen]

Should we mention the SBOM file format here?

[kichristensen]

We should also add some documentation around this