Generating SBOMs for container images once they're built by TaskRun

Feature request

We (w/@dentrax @erkanzileli) propose generating SBOMs once the images are built when Taskrun has been completed, then signing them. I want to list the tools that can help us to do that:

• https://github.com/anchore/syft
• https://github.com/anchore/sbom-action
• https://github.com/CycloneDX/gh-gomod-generate-sbom
• https://github.com/spdx/spdx-sbom-generator
• https://github.com/tern-tools/tern
• https://github.com/CycloneDX/cyclonedx-cli
• https://github.com/kubernetes/release/tree/master/cmd/bom

cc: @luhring @puerco @cpanato @nishakm @dlorenc

Use case

SBOMs are really needed to understand the software and libraries being used during your build and deployment cycle. There are several methods designed specifically for delivering SBOMs, including SPDX (Software Package Data Exchange), Software Identification (SWID) Tags, and Cyclone DX. So, we can use one of these formats to identify how our images were built during the Tekton Pipeline process.

Start by reviewing the completed TaskRun flow and how built container images are handled. Compare the listed SBOM tools and formats, then define a path that generates and signs an SBOM after image completion; done means the selected approach is integrated into the Tekton Pipeline process.