feat: creating kaniko build artifact metadata

[anilkeshav27]

Description

Checklist

• Tests
• Documentation
• Inner source library needs updating

[manjunathSurendrakumar]

@anilkeshav27 Please add tests to the new functions introduced

[manjunathSurendrakumar]

This will be tracked by DMS or sentinel to make the change when the issue is fixed?

[anilkeshav27]

currently there is no plan from the syft team itself for the fix so its hard to commit, but whenever the sbom topic is handelled centrally will hand over

[manjunathSurendrakumar]

@anilkeshav27 When I tried to build multiple images I get wrong buildPath for example:

Project structure:
multi-docker/sub-dir1/Dockerfile
multi-docker/sub-dir2/Dockerfile
Dockerfile

For all the Dockerfiles the BuildPath is root directory as value ".", the path to the build descriptor is essential isn't it?

[anilkeshav27]

@anilkeshav27 When I tried to build multiple images I get wrong buildPath for example:

Project structure: multi-docker/sub-dir1/Dockerfile multi-docker/sub-dir2/Dockerfile Dockerfile

For all the Dockerfiles the BuildPath is root directory as value ".", the path to the build descriptor is essential isn't it?

currently the buildPath is not needed for downstream application, but i can take it up as a follow up task to fix after this PR

[anilkeshav27]

@anilkeshav27 Please add tests to the new functions introduced

have included the unit test

[manjunathSurendrakumar]

@anilkeshav27 When I tried to build multiple images I get wrong buildPath for example:
Project structure: multi-docker/sub-dir1/Dockerfile multi-docker/sub-dir2/Dockerfile Dockerfile
For all the Dockerfiles the BuildPath is root directory as value ".", the path to the build descriptor is essential isn't it?

currently the buildPath is not needed for downstream application, but i can take it up as a follow up task to fix after this PR

My understanding for signature scan is, SBOM and its corresponding build descriptor path are required. Could you please confirm again this is not the case?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[manjunathSurendrakumar]

/it-go

[manjunathSurendrakumar]

LGTM

[github-actions]

Thank you for your contribution! This pull request is stale because it has been open 60 days with no activity. In order to keep it open, please remove stale label or add a comment within the next 10 days. If you need a Piper team member to remove the stale label make sure to add @SAP/jenkins-library-team to your comment.