Add option to specify SBOM format

[mqf20]

Currently, buildkit-syft-scanner generates only SPDX-JSON SBOMs.

Would the maintainers be open to supporting other types of SBOMs (e.g., CYCLONEDX-JSON)?

[cdupuis]

If I remember correctly SDPX is enforced right now on the buildkit side. See https://github.com/moby/buildkit/blob/55a7483b0564a7ad5b2ce5e62512789dce327bca/frontend/attestations/sbom/sbom.go#L103.

@tonistiigi is that something you'd consider changing on the buildkit side? Perhaps get the predicate-type from the created attestation?

[tonistiigi]

Iirc the main reason for it is that buildkit will modify the SBOM to add the layer mapping once it has created the image layers. More formats would mean BuildKit needs to have separate code for all of them.

[ggjulio]

cyclonedx format is more versatile and growing (created after spdx)

To me it would make sense to support the cyclonedx predicate too https://github.com/in-toto/attestation/blob/main/spec/predicates/cyclonedx.md

Currently we use trivy/syft but it's very slow, 3 to 7min.
(context: 12 images in two architecture, 24 sboms generated. Time spent by trivy/syft is mainly fetching layers from the registry. We use a buildkit container, loading images to dockerd is slow, takes space and don't work well with multiarch images. So the best approach would be to use a scanner plugin)