Added way to configure SBOM scanner

[LaurentGoderre]

This addresses #3791.

Using the following scanner image

FROM alpine

CMD [ "printenv" ]

With the following command:

echo "FROM alpine" | docker buildx b . --progress=plain --no-cache -f - --sbom=generator=laurentgoderre689/mock-scanner,EXTRA_SCANNERS=test

Yields

#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 49B done
#1 DONE 0.0s

[...]

#8 DONE 0.7s

#9 [linux/arm64] generating sbom using docker.io/laurentgoderre689/mock-scanner:latest
#9 0.037 BUILDKIT_SCAN_DESTINATION=/run/out/
#9 0.037 BUILDKIT_SCAN_SOURCE=/run/src/core/sbom
#9 0.037 BUILDKIT_SCAN_type=sbom
#9 0.037 BUILDKIT_SCAN_EXTRA_SCANNERS=test
#9 DONE 0.1s

This also addresses the concerns about comma in values.

Running

echo "FROM alpine" | docker buildx b . --progress=plain --no-cache -f - --sbom="\"generator=laurentgoderre689/mock-scanner\",\"EXTRA_SCANNERS=test1,test2\""

Yields

#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 49B done
#1 DONE 0.0s

[...]

#7 [linux/arm64] generating sbom using docker.io/laurentgoderre689/mock-scanner:latest
#7 0.053 BUILDKIT_SCAN_DESTINATION=/run/out/
#7 0.053 BUILDKIT_SCAN_SOURCE=/run/src/core/sbom
#7 0.053 BUILDKIT_SCAN_type=sbom
#7 0.053 BUILDKIT_SCAN_EXTRA_SCANNERS=test1,test2
#7 DONE 0.1s

[jedevc]

LGTM, would also be good to add a test to client_test.go as well to check the correct env vars are set in the scanner env?

[tonistiigi]

Yes, integration test would be good. CI is also failing in linter.

[LaurentGoderre]

On it!

[tonistiigi]

@jedevc PTAL

[jedevc]

Lgtm, sorry for the delay 🎉