Typed packaged data

[jedevc]

We have basic support for typed packages:

go-imageinspect/sbom.go

Lines 33 to 36 in 94b9479

	type SBOM struct {
	AlpinePackages []Package `json:",omitempty"`
	UnknownPackages []Package `json:",omitempty"`
	}

We should extend this to the core packages we commonly use in Docker projects so we can check this works 🎉

• Go packages
• Debian/Ubuntu packages
• Alpine packages

We should also ideally rework the structures to be unique for each package, since packages of type X may allow different fields than packages of type Y. They should have a common base though, since many fields are shared.

If we can, it would be good to capture the graph-relationships between packages, which syft/other scanners have the potential to generate.

[tonistiigi]

Replaced by #21