feat(CLOUDDST-24366) Update description of show-sbom

[emilyzheng]

SPDX format will be supported by build-definitions later. Update description of show-sbom tasks so that they are not limited to CycloneDX.

[emilyzheng]

@rcerven @taylormadore could you please review this?

[rcerven]

@arewm should there be mention about spdx, if we aren't even generating sbom in spdx ?

[arewm]

The implementation isn't specific to either cyclonedx nor spdx. If we want to change this, I think we should actually remove the wording instead of adding more.

Can SPDX even be attached or does it have to be an attestation? If the latter, then the current task definition won't be able to show the SPDX sbom.

[midnightercz]

The implementation isn't specific to either cyclonedx nor spdx. If we want to change this, I think we should actually remove the wording instead of adding more.

Can SPDX even be attached or does it have to be an attestation? If the latter, then the current task definition won't be able to show the SPDX sbom.

I thought we already produce sboms in attestations

[emilyzheng]

@midnightercz So will spdx sbom be attached like what's done for cyclonedx sbom in upload-sbom? Or buildah tasks will generate it as attestation? I think spdx is supported by cosign attach sbom:

$ cosign attach sbom --help
...
    --type='spdx':
	type of sbom (spdx|cyclonedx|syft)

[midnightercz]

So I checked and most of the tekton tasks use sbom attach --sbom-type=, where is cyclonedx or spdx based on task paramater

[emilyzheng]

@arewm @rcerven I've changed it to not mentioning any sbom type. Could you review again?

[arewm]

Regarding my prior question

Can SPDX even be attached or does it have to be an attestation? If the latter, then the current task definition won't be able to show the SPDX sbom.

SPDX can be attached. The process using cosign attach isn't specific to a particular SBOM type.

[arewm]

Merging without CI as this is just a change to the descriptions.