Capture data for sbom diff
Background
In order to perform SBOM diffs, we should capture the parent image's digest and add the access log from the build job to the SBOM upload using ORAS.
Base images (UBI) don't need to have a parent digest stored.
This captures all data needed to support an SBOM diff.
Acceptance Criteria
-
Add base_image's digest as a label to images -
Add access_log to in-registry artifacts (.sbom oras?)
Definition of Done
-
Access log is a part of the SBOM in the registry -
Base image digest label found upon image inspection
Edited by Michael Simmons