BREAKING CHANGE: change 'trivy sbom' to scan SBOM

[knqyf263]

Summary

Replace trivy sbom with --format cyclonedx, --format spdx, etc.

Before

trivy sbom used to generate the SBOM output.

$ trivy sbom --sbom-format cyclonedx --artifact-type image alpine:3.15

or

$ trivy sbom --sbom-format spdx --artifact-type fs /app/myproject

After

trivy sbom is for scanning SBOM from v0.30.0. Instead, you can generate the SBOM output with the --format flag that is available under each subcommand like image and fs.

$ trivy image --format cyclonedx alpine:3.15

or

$ trivy fs --format spdx /app/myproject

Affected versions

v0.30.0 or greater

Description

To be consistent with other trivy subcommands, we are changing trivy sbom to scan SBOM for vulnerabilities, rather than generate SBOM.

• trivy image scans container images
• trivy fs scans filesystems
• triivy sbom scans SBOM from v0.30.0

[adazzi93933]

I am using it this way ...

trivy fs --format cyclonedx $CI_DOCKER_TAR_IMAGE --output $CI_JSON_SBOM