Vulnerability insights between deployments

I'll preface this issue by saying this. I have recently (30ish minutes ago) learned about something, and feel it could be applied here. There's a strong possibility it cannot, and would be more than happy to forget about it and move on.

---

rpm-ostree provides a nice security overview of vulnerabilities fixed between the current and staged deployment, which would be very handy to have here. I know bootc doesn't have (or is trying to remove?) the tight integration with the package manager, so doing this through rpm-ostree could be problematic, and need rework in the near future.

This gets me to the thing I have recently found out about - the referrers API, and attaching artifacts to OCI images ([video](https://youtu.be/_c1OdmP9Ssg)).

In this wild idea, bootc could query the OCI registry for SBOMs of the current image and staged image. From these two SBOMs, it might be trivial to work out the diff and be able to say which packages or binaries have resolved vulnerabilities.

All logic to scan the image and detect vulnerabilities would be offboarded to specialised tooling as part of the CI process, such as syft, and bootc would need to make a couple queries to a registry and learn how to ingest and compare data from an SBOM.

1. Bootc stages a new deployment
2. Bootc queries the registry for an image artifact of mediaType [`application/spdx+json`](https://www.iana.org/assignments/media-types/application/spdx+json), ingesting the data
3. Bootc compares the SBOM data from the current and staged deployments, informing the user as part of `bootc status` or `bootc update`

Please let me know if this is not possible, or if there are better ways to approach the problem.

Thanks,
Rob

Inizia esaminando come bootc gestisce la preparazione del deployment e l’output di `bootc status` o `bootc update`, quindi valuta la Registry Referrers API e i dati SPDX SBOM descritti nell’issue. Confronta gli SBOM delle immagini correnti e preparate e definisci come devono essere segnalate le vulnerabilità risolte; l’issue è completata quando sono state stabilite la fattibilità e l’ambito dell’implementazione.

Scritto dal modello di indicizzazione a partire dal testo della issue.