Generate SBOMs

[tschmidtb51]

We need a workflow to automatically generate SBOMs for each release for both: SPDX and CycloneDX.

[peinjoh]

SBOM generation for rust projects has been the topic of multiple RFCs (rust-lang/rfcs#2801, rust-lang/rfcs#3553), with the recent RFC 3553 implementation making it to nightly in February 2025.

RFC 3553 concerns the generation of a pre-cursor SBOM though. This pre-cursor still needs to be parsed by an external tool.

There are multiple OSS tools for this. I propose we try out https://github.com/anchore/syft. They also provide ready-made Github Actions to use the tool (https://github.com/anchore/sbom-action) and add the sbom files to the github releases.

Syft can work based on the cargo.lock file. This can be improved by using https://github.com/rust-secure-code/cargo-auditable to embed a dependency tree representation in the compiled binaries, which defines the exact crate versions used. Syft also supports this auditable binary. For context, cargo-auditable is also the direct result of the first RFC 2801.

When RFC 3553 has been it to stable, cargo-auditable also already supports using the pre-cursor format.

Additionally, DevGuard seems like a promising alternative I'd like to explore, as they are also active in the CSAF space and can also export (among others) SPDX and CDX SBOMs.

To summarize, I propose we:

• add cargo-auditable in the build step
• add the syft github automation
• request access to the hosted DevGuard instance and test out the github integration and SBOM export features there