Re-enable scanning for SBOM records in Docker image

[nycnewman]

In a slightly dated Docker Blog post, it was highlighted that you could add SBOM details for any binaries added manually to a Docker image:

https://www.docker.com/blog/generate-sboms-with-buildkit/

This was broken some time back apparently and the blog also references a snippet that does not work (need to be a full SBOM package record).

Syft maintainers suggested a minor fix to re-enable this feature:

buildkit-syft-scanner/internal/target.go

Line 49 in f22f986

result, err := syft.CreateSBOM(context.Background(), src, syft.DefaultCreateSBOMConfig().WithCatalogerSelection(pkgcataloging.NewSelectionRequest().WithDefaults(pkgcataloging.ImageTag)))

syft.CreateSBOM(context.Background(), nil, syft.DefaultCreateSBOMConfig().
WithCatalogerSelection(pkgcataloging.NewSelectionRequest().
WithDefaults(pkgcataloging.ImageTag).

•   	WithAdditions("sbom-cataloger"),
  

  ),
  )

Full discussion with Syft is here:

anchore/syft#3490 (comment)

[jedevc]

Hm, we should also have had tests for this case.

[nycnewman]

Tried to create a PR but hit a ton of issues (as I'm not a GoLang expert) with Syft and case of "microsoft" vs "Microsoft" in Syft dependencies. Since this project pulls in both github.com/Microsoft and github.com/microsoft, it picks capitalized version and fails on syft dependencies.

[nycnewman]

Similar issue to anchore/syft#2026

[cdupuis]

This is now fixed in master via #115.