feat(sbom): add CoreOS support

[DmitriyLewen]

Description

CoreOS uses specific path to rpm DB - /usr/share/rpm/rpmdb.sqlite.
We need to add support this path.

Required changes:

• add new path into requiredFiles + add comment that this path for CoreOS
• add new OS analyzer or update one of actual analyzer.
• add new detector (to avoid errors when vuln scanner is enable).
  • create coreos package here. Trivy doesn't support vuln detection, so use bottlerocket.go file as example.
  • add new detector into driver map
• update docs:
  • add CoreOS page
    • create new coreos.md file here
    • add this file into mkdocs.yaml
  • add CoreOS into supported OS table. Write about SBOM only support.

Discussed in #9188

[amitverse]

Hi, I'm interested in this case. Can i take it?

[amitverse]

hello @knqyf263 @DmitriyLewen , i need a help regarding the OS analyzer.

when i inspect the image quay.io/almalinuxorg/atomic-desktop-kde:10, i found that it has a file os-release with file-path usr/lib/os-release which contains the os informataion.

The usr/lib/os-release file-path is already supported in

trivy/pkg/fanal/analyzer/os/release/release.go

Line 22 in 4359fe0

"usr/lib/os-release",

but it doesn't support almalinux through os-release file-

trivy/pkg/fanal/analyzer/os/release/release.go

Line 51 in 4359fe0

switch id {

so, adding almalinux here will work right? can i go ahead with this information?

or i need to investigate more?

[DmitriyLewen]

Hello @amitverse
This issue about CoreOS only.
So you don't need to add analyzers for Atomic Alma or Atomic Fedora.

i found that it has a file os-release with file-path usr/lib/os-release which contains the os informataion.

What about etc/almalinux-release file?