feat: integrate sbom generation to goreleaser

[tricky42]

Securing the Software Supply Chain becomes more and more critical. This PR will generate a SBOM using cyclonedx-gomod for each binary. Users can use the SBOM to get full transparency of existing vulnerabilities in a given releaee.

Related issue(s)

n/a

Checklist

• I have read the contributing guidelines.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security. vulnerability, I
  confirm that I got green light (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

[tricky42]

Open tasks:

• naming of SBOM files need to use the same replacements as used in archives section so *.bom.json files match the archive files they are created for
• test release process to ensure *.bom.json files included in release artifacts

I looked at the cylconedx-gomod repository for inspiration:

• repository: https://github.com/CycloneDX/cyclonedx-gomod
• Integration into goreleaser: SBOM generation | Adding SBOM to release artifacts
• release artifacts:
  

[tricky42]

Log from running the build locally:

➜ docker run --mount type=bind,source="$(pwd)",target=/project \
    -v /var/run/docker.sock:/var/run/docker.sock \
    oryd/xgoreleaser:latest --skip-publish --snapshot --rm-dist
   • releasing...             
   • loading config file       file=.goreleaser.yml
   • loading environment variables
   • getting and validating git state
      • building...               commit=e7e4a4a7cafdd720803dd250b535cc1b0bf9e16f latest tag=v0.8.0-alpha.3
      • pipe skipped              error=disabled during snapshot mode
   • parsing tag              
   • running before hooks     
      • running                   hook=go mod download
      • running                   hook=go mod tidy
      • running                   hook=go install github.com/CycloneDX/[email protected]
   • setting defaults         
      • snapshotting             
      • github/gitlab/gitea releases
      • project name             
      • loading go mod information
      • building binaries        
      • creating source archive  
      • archives                 
      • linux packages           
      • snapcraft packages       
      • calculating checksums    
      • signing artifacts        
      • signing docker images    
      • docker images            
      • docker manifests         
      • artifactory              
      • blobs                    
      • homebrew tap formula     
      • scoop manifests          
      • twitter                  
      • reddit                   
      • slack                    
      • milestones               
   • snapshotting             
      • building snapshot...      version=v0.8.0-alpha.3-next
   • checking ./dist          
      • --rm-dist is set, cleaning it up
   • loading go mod information
   • writing effective config file
      • writing                   config=dist/config.yaml
   • generating changelog     
      • pipe skipped              error=not available for snapshots
   • building binaries        
      • building                  binary=/project/dist/kratos-sqlite-darwin_darwin_amd64/kratos
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next-sqlite_darwin_amd64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next-sqlite_darwin_amd64.bom.json"
      • building                  binary=/project/dist/kratos-sqlite-darwin-arm_darwin_arm64/kratos
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next-sqlite_darwin_arm64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next-sqlite_darwin_arm64.bom.json"
      • building                  binary=/project/dist/kratos-sqlite-linux_linux_amd64/kratos
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next-sqlite_linux_amd64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next-sqlite_linux_amd64.bom.json"
      • building                  binary=/project/dist/kratos-sqlite-linux-libmusl_linux_amd64/kratos
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next-sqlite-libmusl_linux_amd64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next-sqlite-libmusl_linux_amd64.bom.json"
      • building                  binary=/project/dist/kratos-sqlite-windows_windows_amd64/kratos.exe
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next-sqlite_windows_amd64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next-sqlite_windows_amd64.bom.json"
      • building                  binary=/project/dist/kratos_darwin_arm64/kratos
      • building                  binary=/project/dist/kratos_linux_arm_6/kratos
      • building                  binary=/project/dist/kratos_windows_arm_7/kratos.exe
      • building                  binary=/project/dist/kratos_windows_arm_5/kratos.exe
      • building                  binary=/project/dist/kratos_windows_arm64/kratos.exe
      • building                  binary=/project/dist/kratos_windows_arm_6/kratos.exe
      • building                  binary=/project/dist/kratos_linux_arm64/kratos
      • building                  binary=/project/dist/kratos_linux_arm_7/kratos
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_linux_arm_7.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_linux_arm_6.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_linux_arm64.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_windows_arm_5.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_windows_arm_7.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_windows_arm64.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_windows_arm_6.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_darwin_arm64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_windows_arm_6.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_windows_arm_7.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_linux_arm_7.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_windows_arm64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_windows_arm_5.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_linux_arm_6.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_linux_arm64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_darwin_arm64.bom.json"
      • building                  binary=/project/dist/kratos_darwin_amd64/kratos
      • building                  binary=/project/dist/kratos_windows_amd64/kratos.exe
      • building                  binary=/project/dist/kratos_windows_386/kratos.exe
      • building                  binary=/project/dist/kratos_linux_386/kratos
      • building                  binary=/project/dist/kratos_linux_amd64/kratos
      • building                  binary=/project/dist/kratos_linux_arm_5/kratos
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_linux_amd64.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_windows_amd64.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_darwin_amd64.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_linux_arm_5.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_linux_386.bom.json"
      • running hook              hook=cyclonedx-gomod app -licenses -json -output "./dist/kratos_v0.8.0-alpha.3-next_windows_386.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_darwin_amd64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_linux_amd64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_windows_amd64.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_linux_arm_5.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_linux_386.bom.json"
      • running hook              hook=./.releaser/rename.sh "./dist/kratos_v0.8.0-alpha.3-next_windows_386.bom.json"
   • archives                 
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next-sqlite_macos_64bit.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next-sqlite_macos_arm64.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next-sqlite_linux_64bit.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next-sqlite_windows_64bit.zip
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_windows_arm32v7.zip
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next-sqlite-libmusl_linux_64bit.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_windows_arm32v5.zip
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_linux_64bit.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_linux_arm32v5.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_windows_64bit.zip
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_linux_32bit.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_linux_arm64.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_macos_64bit.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_windows_32bit.zip
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_linux_arm32v6.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_windows_arm32v6.zip
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_windows_arm64.zip
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_macos_arm64.tar.gz
      • creating                  archive=dist/kratos_v0.8.0-alpha.3-next_linux_arm32v7.tar.gz
   • creating source archive  
   • linux packages           
   • snapcraft packages       
   • calculating checksums    
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_macos_arm64.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_64bit.zip
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_32bit.zip
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm32v5.zip
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_windows_64bit.zip
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm32v7.zip
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_32bit.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_windows_64bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_64bit.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm32v5.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite-libmusl_linux_64bit.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm32v5.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_macos_64bit.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm32v6.zip
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm64.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm64.zip
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm32v6.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm32v7.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_macos_64bit.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_macos_arm64.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_linux_64bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_macos_arm64.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_32bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm64.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm32v7.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite-libmusl_linux_64bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_macos_64bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_32bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm32v6.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_64bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm32v6.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_macos_64bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_64bit.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm32v7.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_macos_arm64.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next-sqlite_linux_64bit.tar.gz
      • checksumming              file=kratos_v0.8.0-alpha.3-next_linux_arm32v5.bom.json
      • checksumming              file=kratos_v0.8.0-alpha.3-next_windows_arm64.bom.json
   • signing artifacts        
   • docker images            
      • building docker image     image=oryd/kratos:v0
      • building docker image     image=oryd/kratos:v0-sqlite
      • pipe skipped              error=publishing is disabled
   • publishing               
      • blobs                    
      • http upload              
      • custom publisher         
      • artifactory              
      • docker images            
         • pipe skipped              error=publishing is disabled
      • docker manifests         
         • pipe skipped              error=publishing is disabled
      • snapcraft packages       
         • pipe skipped              error=publishing is disabled
      • github/gitlab/gitea releases
         • pipe skipped              error=publishing is disabled
      • homebrew tap formula     
         • writing                   formula=dist/kratos.rb
         • pipe skipped              error=publishing is disabled
      • scoop manifests          
         • writing                   manifest=dist/kratos.json
         • pipe skipped              error=publishing is disabled
      • milestones               
         • pipe skipped              error=publishing is disabled
   • signing docker images    
      • pipe skipped              error=artifact signing is disabled
   • announcing               
      • twitter                  
         • pipe skipped              error=announcing is disabled
      • reddit                   
         • pipe skipped              error=announcing is disabled
      • slack                    
         • pipe skipped              error=announcing is disabled
   • release succeeded after 1105.81s